Cisco 300-725 SWSA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

WCCP service group

A router/switch (WCCP server) and one or more WSA caches that share a service ID; the router redirects matching traffic to the WSA and the WSA returns it via GRE.

Transparent proxy mode

The client is unaware of the proxy; traffic is redirected by WCCP or Layer 4 redirection to the WSA, which uses the original destination to make policy decisions.

Explicit proxy mode

The client is configured with the WSA address and port (or a PAC file) and sends absolute-URI requests directly to the appliance for policy evaluation.

PAC file

A JavaScript file containing FindProxyForURL that tells browsers which proxy to use per URL; commonly returns DIRECT for internal destinations to avoid hairpinning.

Management vs data interface

On the WSA, the M1/P1 interface carries management (GUI, SSH, upgrades) while the P2 data interface carries user web traffic; mixing them breaks redirection and security.

HA virtual IP

In a WSA HA pair, a shared IP address owned by the active appliance for data traffic, plus a separate management VIP, which move on failover.

S-Series sizing factors

Model selection depends on concurrent connections, requests per second, and throughput; enabling decryption and DLP increases CPU and memory demand beyond baseline figures.

Default proxy ports

The WSA commonly listens on TCP 3128 for HTTP proxy and 3129 for HTTPS proxy, in addition to standard 80/443 when configured for transparent or explicit service.

NTLM transparent authentication

The WSA authenticates domain-joined clients silently via NTLM against Active Directory; it requires reachability to the domain controller and a fallback action on failure.

SAML 2.0 authentication

Identity is asserted by an external IdP using signed SAML assertions; the WSA must import IdP metadata, match entity IDs and ACS URL, and keep clocks synchronized.

Identity policy

A policy that determines how users are identified (authentication sequence, surrogates, fallback) before access policies evaluate URL category and application.

Authentication surrogate

A cached mapping of client IP (or subnet) to authenticated username; stale surrogates cause a user to inherit another user's identity and policy.

First-match policy evaluation

Access, decryption, and identity policies are evaluated top-down and the first matching rule applies; rule order therefore determines the effective action.

Custom URL category

An administrator-defined list of URLs or domains that can be allowed or blocked independently of the Talos global categories, useful for business exceptions.

Application visibility and control

Signature-based identification of applications regardless of port or URL, allowing allow, block, or bandwidth actions for streaming, P2P, and social media.

AUP acknowledgement page

A configurable block/consent page shown before access is granted; the user must accept the acceptable use policy, and the acceptance can be logged.

Quota enforcement

Per-user or per-group time or volume limits attached to access policies; when exhausted, the configured action (block or throttle) applies until reset.

Anti-malware scanning engines

Sophos and McAfee engines scan downloaded files; each file is scanned by enabled engines and the most severe verdict determines the action taken.

Web reputation score

A Talos-assigned score reflecting site trustworthiness, independent of URL category; access policies can match reputation ranges to block risky sites.

File reputation and AMP

Cisco Advanced Malware Protection sends file hashes for cloud reputation and analysis; verdicts can change retrospectively, generating alerts on previously allowed files.

Maximum scan size

A configured file-size limit above which files are not scanned; files beyond the limit follow the configured pass or block action and can evade DLP and anti-malware.

License dependency

Anti-malware engines, Web reputation, AMP, and DLP each require a valid license; expiration disables the feature or forces a fallback action, so status must be monitored.

Decryption policy

A separate policy from access policy that decides per connection whether to decrypt, pass through, or drop HTTPS traffic based on category, user, and certificate properties.

Decryption certificate authority

The WSA's internal CA (or subordinate CA) that signs certificates presented to clients during decryption; clients must trust the root or see certificate warnings.

Pass-through action

A decryption policy action that leaves the TLS session encrypted end-to-end, so the WSA cannot inspect content, URLs beyond SNI, or files in that flow.

Certificate validation

A decryption setting that makes the WSA verify the upstream server certificate chain; failures can be set to drop or pass through the connection.

DLP classifier

A predefined or custom pattern (credit card, SSN, regex, keywords) that DLP rules match against content; thresholds on match counts reduce false positives.

DLP monitor vs block

Monitor logs incidents without stopping the transfer, while block prevents the upload or download; both require decryption for HTTPS destinations to see content.

Configuration backup

An export of WSA policies, settings, and optionally private keys; backups are release-specific and should be taken before upgrades and stored off the appliance.

Syslog subscription

A configured export of access, system, or traffic logs to an external collector at a chosen severity; used for long-term retention beyond the local reporting database.

Policy trace tool

A GUI tool that shows which identity, decryption, and access policies match for a given user, client IP, URL, and time, without waiting for live traffic.

NTP requirement

Accurate time is required for Kerberos and SAML authentication, certificate validity checks, and log correlation; clock drift causes authentication failures and misleading reports.