A company is deploying a transparent proxy to monitor all outbound HTTP/HTTPS traffic. They are concerned about the performance impact of SSL inspection on the proxy server. They need to balance security visibility with user experience. Which approach best addresses this trade-off?

Use SSL inspection selectively for traffic to high-risk categories (e.g., file sharing, malware domains) and bypass inspection for trusted sites like banking and healthcare.

Deploy a dedicated SSL inspection appliance in addition to the proxy, so the proxy does not handle decryption.

Perform SSL inspection on all traffic, accepting the performance overhead to ensure full visibility.

Skip SSL inspection entirely and only log the CONNECT requests to HTTPS destinations.

A company wants to deploy a proxy that can handle both HTTP and HTTPS traffic and provide caching to reduce bandwidth usage. They also need to be able to authenticate users against Active Directory. Which open source proxy is most appropriate?

HAProxy with LDAP authentication and caching enabled.

Squid with SSL bump for HTTPS inspection and LDAP authentication, with caching enabled.

Apache with mod_proxy and mod_ldap.

Nginx with proxy_cache and LDAP authentication.

During a forensic investigation, an analyst needs to identify all users who accessed a specific prohibited website through the corporate Squid proxy over the past month. The proxy uses NTLM authentication. Which log field and analysis method will provide the most reliable user attribution?

Use the username field in the Squid access log (if enabled) and filter for the domain of the prohibited website.

Use the client IP address from the Squid access log and map it to users using DHCP lease logs.

Analyze the raw TCP dump from the proxy server to extract usernames from NTLM handshakes.

Check the proxy's cache log to see which users requested the website.

A security analyst wants to monitor all outbound HTTP/HTTPS traffic from a network segment without requiring each client to be configured with proxy settings. Which proxy placement and configuration best achieves this?

Deploy a reverse proxy in front of the web servers and configure it to log all requests

Set up a network tap on the core switch and capture traffic with Wireshark

Place a transparent forward proxy inline on the network path and redirect traffic using policy-based routing or a bump-in-the-wire configuration

Install a forward proxy on each client machine and configure the browser to use it

Which field in a Squid access log (access.log) typically contains the requested URL?

The last field of the log entry

The first field of the log entry

The field immediately after the HTTP status code

The field after the timestamp and client IP

GIAC Network Forensic Analyst

Domain 3Objective 1

Open Source Network Security Proxies GNFA Practice Questions (Page 8)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 36–40

36expert · hard
A company is deploying a transparent proxy to monitor all outbound HTTP/HTTPS traffic. They are concerned about the performance impact of SSL inspection on the proxy server. They need to balance security visibility with user experience. Which approach best addresses this trade-off?
Select an answer first
37application · medium
A company wants to deploy a proxy that can handle both HTTP and HTTPS traffic and provide caching to reduce bandwidth usage. They also need to be able to authenticate users against Active Directory. Which open source proxy is most appropriate?
Select an answer first
38application · medium
During a forensic investigation, an analyst needs to identify all users who accessed a specific prohibited website through the corporate Squid proxy over the past month. The proxy uses NTLM authentication. Which log field and analysis method will provide the most reliable user attribution?
Select an answer first
39foundation · easy
A security analyst wants to monitor all outbound HTTP/HTTPS traffic from a network segment without requiring each client to be configured with proxy settings. Which proxy placement and configuration best achieves this?
Select an answer first
40foundation · easy
Which field in a Squid access log (access.log) typically contains the requested URL?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.