CAS-005 · Question #439
A security analyst wants to keep track of all outbound web connections from workstations. The analyst's company uses an on-premises web filtering solution that forwards the outbound traffic to a…
The correct answer is B. X-Forwarded-For. The X-Forwarded-For header is specifically designed to carry the original client’s IP address through proxy or NAT devices. By having the web filter inject the workstation’s real source IP into this header on each HTTP request, downstream systems (like your firewall logs or…
Question
A security analyst wants to keep track of all outbound web connections from workstations. The analyst’s company uses an on-premises web filtering solution that forwards the outbound traffic to a perimeter firewall. When the security analyst gets the connection events from the firewall, the source IP of the outbound web traffic is the translated IP of the web filtering solution. Considering this scenario involving source NAT, which of the following would be the best option to inject in the HTTP header to include the real source IP from workstations?
Options
- AX-Forwarded-Proto
- BX-Forwarded-For
- CCache-Control
- DStrict Transport Security
- EContent-Security-Policy
How the community answered
(26 responses)- A4% (1)
- B85% (22)
- C4% (1)
- E8% (2)
Explanation
The X-Forwarded-For header is specifically designed to carry the original client’s IP address through proxy or NAT devices. By having the web filter inject the workstation’s real source IP into this header on each HTTP request, downstream systems (like your firewall logs or SIEM) can extract the true client IP instead of the filter’s translated address.
Community Discussion
No community discussion yet for this question.