The monitor is there to see if someone is messing with access to the system and checks to see if the "securities" were disabled.
Proxies prevent data changes(ex:logs, academic records,etc.)
Firewalls(I believe ) have to do with the fileserver(deleting and copying)
but when you pass the monitoring system the unauthorized security alarm (you could say) alerts the administration and he begins to try and find you to stop what you are doing.
the monitor has nothing to do with the tracking when inside the system that is the administration.
Does this help?
------------------
Deep into that
darkness peering,
long I stood there,
wondering, fearing,