hardMultiple Select

200-201 Practice Question: Which TWO of the following are valid reasons to…

Which TWO of the following are valid reasons to use a proxy server for security monitoring? (Choose two.)

⚠ Common exam trap

200-201 often tests the capabilities and limitations of proxy servers; candidates may think proxies reduce latency or replace endpoint security, but they actually add latency and are not a substitute for anti-malware.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To inspect encrypted traffic by acting as a man-in-the-middle with SSL decryption

Option C is correct because a proxy can terminate TLS connections and perform SSL/TLS inspection (SSL decryption or break-and-inspect), decrypting traffic so it can be examined for malicious content before re-encrypting it to the destination. Option D is correct because a forward proxy sits inline on outbound traffic and can enforce access-control policies, URL/domain filtering, and block connections to known malicious destinations via threat-intelligence feeds. Option A is not a security-monitoring reason and proxies typically add latency rather than reduce it. Option B is inaccurate because a proxy only logs traffic that is routed through it, not all network traffic, so it cannot provide a complete forensic record. Option E is wrong because a proxy does not replace endpoint anti-malware; host-based protection is still required for local threats.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To reduce network latency for monitored traffic
Why it's wrong here
Proxies add an inspection hop, caching and policy checks that increase latency rather than reduce it. It is tempting because caching genuinely speeds repeated content delivery, making a proxy correct when the requirement is bandwidth conservation or faster retrieval of frequently requested resources.
✗
To provide a complete log of all network traffic for forensics
Why it's wrong here
A proxy logs only the sessions routed through it, so traffic bypassing it or using non-proxied protocols is absent, preventing a complete forensic record. It is tempting because proxy logs are rich and centralised, making them correct when the requirement is application-layer visibility for web-bound traffic.
✓
To inspect encrypted traffic by acting as a man-in-the-middle with SSL decryption
Why this is correct
SSL interception lets the proxy terminate the client's TLS session, decrypt the payload, inspect it, then re-encrypt toward the destination. This satisfies the stem's monitoring requirement by exposing threats hidden inside HTTPS, which passive network capture cannot read. Microsoft Entra ID conditional access is unaffected, as the proxy sits inline on the traffic path.
✓
To enforce outbound access policies and block connections to known malicious destinations
Why this is correct
A proxy terminates outbound sessions, so it can apply policy decisions on destination and protocol, blocking connections to known malicious hosts. This satisfies the stem's requirement for security monitoring through enforced outbound access control at the egress point.
✗
To replace the need for endpoint anti-malware software
Why it's wrong here
A proxy inspects and logs traffic flows; it cannot scan endpoint filesystems, memory or processes, so malware on a host remains undetected. It is tempting because proxies do filter URLs and block malicious destinations, which is genuinely useful for egress control and web monitoring, but that is content inspection, not host protection.

Visual reference

Go deeper

200-201 Practice Question: Which TWO of the following are valid reasons to…

Why each option matters

Option-by-option breakdown

Related to this question