I85PREP
⌘ K
Cisco 300-725 SWSA study materials
Cisco 300-725 SWSA study resources

Cisco 300-725 SWSA practice questions

One question at a time. Build your Cisco 300-725 SWSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

In a Cisco WSA deployment, which component is responsible for accepting client connections and enforcing access policies before any content is scanned?

  1. The Web Proxy process Correct answer.
  2. The Data Security process
  3. The M-Series log partition
  4. The AsyncOS upgrade manager

Explanation

The Web Proxy process handles client HTTP and HTTPS requests, applies access policies, and decides whether traffic is allowed, blocked, or forwarded for further scanning. Other processes only act after the proxy has accepted and classified the transaction.

Question 2Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which WSA deployment mode requires no client-side configuration because it intercepts traffic transparently at the network layer?

  1. SOCKS proxy
  2. Reverse proxy
  3. Transparent proxy with WCCP Correct answer.
  4. Explicit forward proxy

Explanation

In transparent proxy mode the WSA receives redirected traffic, typically via WCCP from a router or Layer 3 switch, so clients need no browser settings. Explicit mode requires clients to be configured with the proxy address.

Question 3Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

An administrator wants the WSA to receive user identities from an existing Active Directory domain without installing a separate agent on every endpoint. Which identity service should be used?

  1. Transparent user identification via an Active Directory agent Correct answer.
  2. SaaS Single Sign-On
  3. Local WSA user accounts
  4. LDAP authentication with a bind account

Explanation

Transparent user identification uses an Active Directory agent that monitors domain controller security logs and maps client IP addresses to authenticated users, so no per-endpoint software is needed. This lets the WSA apply identity-based policies without prompting users.

Question 4Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which statement accurately describes how the WSA handles an HTTPS connection when HTTPS decryption is enabled for a category?

  1. The WSA presents its own certificate to the client and establishes a separate TLS session to the server Correct answer.
  2. The WSA blocks all HTTPS traffic in that category by default
  3. The WSA forwards the encrypted stream to the upstream router for inspection
  4. The WSA tunnels the TLS session end to end without inspecting the payload

Explanation

With decryption enabled, the WSA terminates the client TLS session using a certificate signed by its trusted root, inspects the plaintext, then re-encrypts to the origin server. This man-in-the-middle design is why the WSA root certificate must be trusted by clients.

Question 5Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

A network team plans to deploy a WSA in a data center and wants inbound web requests to internal servers inspected for attacks. Which deployment option fits this requirement?

  1. Transparent forward proxy
  2. Explicit forward proxy
  3. Reverse proxy Correct answer.
  4. Off-box DLP integration

Explanation

A reverse proxy deployment places the WSA in front of web servers so inbound client requests to those servers are inspected before reaching them. Forward proxy modes instead govern outbound traffic from internal users.

Question 6Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which Cisco WSA form factor is delivered as a virtual machine for hypervisor environments such as VMware ESXi?

  1. Virtual WSA Correct answer.
  2. M-Series
  3. S-Series
  4. C-Series

Explanation

Cisco offers the WSA as a virtual appliance that runs on supported hypervisors, in addition to the hardware S-Series and M-Series platforms. The virtual form factor provides the same AsyncOS feature set without dedicated appliance hardware.

Question 7Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

How does the WSA receive client traffic in a WCCP-based transparent deployment?

  1. A router or switch redirects matching traffic to the WSA using WCCP Correct answer.
  2. The WSA acts as the default gateway for all clients
  3. Clients are configured with a PAC file pointing to the WSA
  4. A DNS server resolves all hostnames to the WSA

Explanation

WCCP allows a Cisco router or Layer 3 switch to intercept matching TCP traffic and redirect it to the WSA, which returns responses through the same path. This enables transparent proxying without changing client browser settings.

Question 8Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which WSA feature allows an administrator to define how the appliance identifies users when transparent redirection prevents a browser authentication prompt?

  1. Proxy authentication with LDAP
  2. Transparent user identification Correct answer.
  3. SAML 2.0 authentication
  4. Basic authentication over HTTP

Explanation

Transparent user identification maps client IP addresses to domain users by reading Active Directory logon events, so policies can be identity-based without prompting. This is essential when transparent redirection prevents interactive authentication.

Question 9Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

An organization wants to send web content to an external DLP service for analysis while keeping policy enforcement on the WSA. Which integration should be configured?

  1. On-box DLP policy
  2. Off-box DLP via ICAP Correct answer.
  3. Web reputation scoring
  4. Anti-malware scanning

Explanation

Off-box DLP uses ICAP to forward content to an external DLP server, which returns a verdict the WSA enforces. On-box DLP performs classification locally instead of sending content to an external service.

Question 10Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which statement best describes the role of the WSA's Data Security process in the appliance architecture?

  1. It manages the WSA's license and upgrade lifecycle
  2. It handles WCCP registration with the network device
  3. It terminates client TCP connections and applies access rules
  4. It inspects content for DLP and malware verdicts after the proxy accepts a transaction Correct answer.

Explanation

The Data Security process performs content-level inspection, including DLP classification and malware analysis, on transactions the proxy has already accepted. It returns verdicts that the proxy uses to allow, block, or monitor the request.

Question 11Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

What is the primary purpose of a PAC file in an explicit proxy deployment?

  1. To encrypt traffic between the client and the WSA
  2. To tell the client browser which proxy to use for a given destination Correct answer.
  3. To authenticate users against Active Directory
  4. To redirect traffic via WCCP

Explanation

A Proxy Auto-Config file contains JavaScript logic that instructs the browser which proxy, if any, to use for each URL. It is a client-side mechanism used in explicit proxy deployments to direct traffic to the WSA.

Question 12Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

A company needs to inspect outbound HTTPS traffic but wants to avoid breaking certificate pinning on certain banking sites. Which WSA configuration addresses this?

  1. Disable HTTPS decryption globally
  2. Enable reverse proxy mode for those sites
  3. Add the banking sites to a decryption policy that tunnels them without inspection Correct answer.
  4. Move the WSA to transparent mode

Explanation

Decryption policies can be scoped so that selected destinations are tunneled without inspection while other HTTPS traffic is decrypted. This preserves certificate pinning for sensitive sites while retaining visibility elsewhere.

Question 13Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which WSA deployment is most appropriate for a branch office that must send all outbound web traffic to a central data center proxy?

  1. A remote proxy that forwards traffic to the central WSA Correct answer.
  2. A reverse proxy protecting local servers
  3. A local explicit proxy with its own policies
  4. A WCCP transparent proxy with a local PAC file

Explanation

A remote proxy configuration lets a branch WSA forward outbound traffic to a central WSA, centralizing policy and logging. This is useful when the organization wants consistent enforcement across sites.

Question 14Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which WSA feature provides a trusted root certificate that clients must import when HTTPS decryption is enabled?

  1. The WCCP service group key
  2. The WSA's HTTPS proxy certificate authority Correct answer.
  3. The DLP ICAP certificate
  4. The Active Directory root CA

Explanation

When the WSA decrypts HTTPS, it presents certificates signed by its own certificate authority, so clients must trust that CA to avoid warnings. Administrators can generate or upload a CA certificate for this purpose.

Question 15Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

How does the WSA determine which access policy applies to a request when multiple policies match?

  1. It applies the policy with the lowest policy number that matches the transaction Correct answer.
  2. It applies all matching policies and merges their actions
  3. It applies the policy with the longest name
  4. It applies the most recently created policy regardless of order

Explanation

Access policies are evaluated in order, and the first matching policy, identified by its policy number, is applied to the transaction. Administrators order policies so that specific rules precede general ones.

Question 16Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which component of the WSA architecture handles logging and reporting data for the appliance?

  1. The Web Proxy process
  2. The M-Series log partition Correct answer.
  3. The AsyncOS kernel
  4. The DLP engine

Explanation

The WSA stores access logs, system logs, and reporting data on the M-Series log partition, which is kept separate from the proxy's working storage. This separation helps preserve log integrity and reporting performance.

Question 17Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

An administrator wants to authenticate users via a browser prompt against Active Directory without deploying an agent. Which WSA feature should be used?

  1. LDAP authentication Correct answer.
  2. SAML 2.0 authentication
  3. Local user authentication
  4. Transparent user identification

Explanation

LDAP authentication prompts the user for credentials and validates them against Active Directory, which works without an agent on endpoints. Transparent identification instead relies on an agent to map IP addresses to users.

Question 18Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which statement about the WSA's handling of HTTP CONNECT requests is correct?

  1. CONNECT requests are always blocked by the WSA
  2. CONNECT establishes a tunnel that the WSA can inspect only if HTTPS decryption is enabled Correct answer.
  3. CONNECT is used only in reverse proxy deployments
  4. CONNECT requests are forwarded to the DLP server for inspection

Explanation

HTTP CONNECT creates a tunnel for HTTPS traffic, which the WSA can inspect only when decryption is enabled for that destination. Otherwise the tunnel is passed through without payload visibility.

Question 19Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

Which WSA deployment option allows a single appliance to serve both inbound and outbound inspection?

  1. Transparent forward proxy only
  2. Combined forward and reverse proxy Correct answer.
  3. Explicit forward proxy only
  4. Off-box DLP only

Explanation

A WSA can be configured to act as both a forward proxy for outbound client traffic and a reverse proxy for inbound requests to protected servers. This combined mode is useful when consolidating inspection on one appliance.

Question 20Describe the Cisco Web Security Appliance (WSA) architecture and deployment options

What is the effect of configuring the WSA to use WCCP with a service group and a redirect ACL?

  1. The ACL authenticates users against Active Directory
  2. Only traffic matching the ACL is redirected to the WSA Correct answer.
  3. The ACL defines which DLP policies apply
  4. All traffic is redirected regardless of the ACL

Explanation

In WCCP, the redirect ACL on the router determines which traffic is intercepted and sent to the WSA, allowing scoped transparent proxying. Traffic that does not match the ACL bypasses the WSA.

Question 21Configure and verify proxy and transparent traffic redirection

On a Cisco WSA, which deployment mode requires the client browser to be explicitly configured with the proxy IP address and port, and does not rely on WCCP or Policy-Based Routing?

  1. SOCKS gateway mode
  2. Explicit forward proxy Correct answer.
  3. Transparent proxy with PBR
  4. Transparent proxy with WCCP

Explanation

In explicit forward proxy mode the client is configured (manually or via PAC file) to send requests to the WSA's proxy interface, so the appliance sees a standard proxy request. WCCP and PBR redirection hide the proxy from the client and are therefore transparent methods.

Question 22Configure and verify proxy and transparent traffic redirection

Which WSA feature is used to redirect client web traffic transparently by having the upstream router intercept and forward it to the appliance?

  1. Proxy Authentication
  2. WCCP Correct answer.
  3. PAC file distribution
  4. HTTPS decryption policy

Explanation

WCCP runs between the WSA and a Cisco router or switch, which intercepts matching traffic and redirects it to the appliance without client configuration. PAC files require client-side proxy configuration, and the other options are unrelated to traffic interception.

Question 23Configure and verify proxy and transparent traffic redirection

A network engineer wants routers to redirect client traffic to the WSA without running a GRE tunnel. Which WCCP service and forwarding method should be configured?

  1. WCCPv2 with L2 return and L2 redirect Correct answer.
  2. WCCPv1 with NAT return
  3. WCCPv2 with GRE encapsulation
  4. WCCPv1 with GRE encapsulation

Explanation

WCCPv2 supports L2 redirect and L2 return, which avoids GRE tunneling by rewriting the destination MAC toward the cache engine. WCCPv1 only supports GRE and lacks the flexible assignment and return methods of v2.

Question 24Configure and verify proxy and transparent traffic redirection

Which statement describes how Policy-Based Routing transparently redirects traffic to a Cisco WSA?

  1. The client browser downloads a PAC file from the WSA.
  2. The router matches client traffic with an ACL and sets the next hop to the WSA proxy interface. Correct answer.
  3. The WSA advertises itself to the router using WCCP hello messages.
  4. The WSA answers ARP requests on behalf of the destination web server.

Explanation

PBR uses a route map with a match ACL and a set ip next-hop (or interface) pointing at the WSA, so packets are forwarded to the proxy without client awareness. WCCP and PAC delivery are separate mechanisms, and ARP spoofing is not part of PBR.

Question 25Configure and verify proxy and transparent traffic redirection

When PBR is used to send client traffic to a WSA, which configuration element on the WSA must be in place for the appliance to accept that traffic as transparent rather than explicit?

  1. The WSA must have the transparent redirection option enabled for the relevant interface, and the PBR next hop must target that interface. Correct answer.
  2. The WSA must have HTTPS proxy enabled on port 443.
  3. The WSA must have the SOCKS proxy enabled.
  4. The proxy port must be changed to 8080.

Explanation

For PBR, the redirected packets arrive at the WSA's data interface and are treated as transparent traffic, so the interface must be configured to accept transparent redirection and the route map must point to it. Changing ports or enabling SOCKS does not create transparent handling.

Question 26Configure and verify proxy and transparent traffic redirection

Which WCCP configuration item tells the router which client traffic should be redirected to the WSA?

  1. The WCCP password
  2. The DNS server address
  3. The WSA hostname
  4. The redirect ACL referenced by the WCCP service group Correct answer.

Explanation

The redirect-list (ACL) attached to the WCCP service group defines which packets the router intercepts and forwards to the cache engine. The password only secures WCCP messages, and hostname or DNS settings do not select traffic.

Question 27Configure and verify proxy and transparent traffic redirection

On the WSA, which service must be enabled for the appliance to participate in WCCP with a router?

  1. The FTP proxy service
  2. The WCCP service on the relevant interface Correct answer.
  3. The DNS cache service
  4. The SMTP relay service

Explanation

The WSA must have the WCCP service enabled and associated with the interface facing the router so it can register with the router's service group. FTP, SMTP, and DNS services do not participate in WCCP registration.

Question 28Configure and verify proxy and transparent traffic redirection

A client using an explicit proxy sends a request for an HTTPS URL. Which method does the browser typically use to reach the proxy?

  1. A CONNECT request to the proxy for the destination host and port Correct answer.
  2. An FTP PORT command to the proxy
  3. A transparent TCP handshake directly with the origin server
  4. A plain HTTP GET to the proxy containing the full URL

Explanation

For HTTPS through an explicit proxy, the browser issues an HTTP CONNECT to the proxy, which then establishes a tunnel to the origin. A plain GET with the full URL is used for HTTP, and transparent interception bypasses the client's proxy configuration entirely.

Question 29Configure and verify proxy and transparent traffic redirection

Which WSA feature lets administrators distribute proxy settings to client browsers so users do not configure them manually?

  1. WCCP
  2. PBR
  3. SSL certificate pinning
  4. PAC file hosting Correct answer.

Explanation

The WSA can host a proxy auto-config (PAC) file that browsers retrieve to learn which proxy to use for a given URL. This is still explicit proxying because the client is aware of and configured for the proxy. WCCP and PBR are transparent methods.

Question 30Configure and verify proxy and transparent traffic redirection

An administrator wants HTTPS traffic to be inspected by the WSA when clients use transparent redirection. What must be configured so the WSA can decrypt the sessions?

  1. An FTP proxy on port 21
  2. A decryption policy with the appropriate certificate authority and HTTPS proxy settings Correct answer.
  3. A WCCP password only
  4. A PAC file on the WSA

Explanation

Transparent HTTPS inspection requires the WSA to present a certificate generated by a CA the client trusts, configured through the decryption policy and HTTPS proxy settings. WCCP passwords, PAC files, and FTP proxying do not enable TLS decryption.

Question 31Configure and verify proxy and transparent traffic redirection

Which condition must be met for the WSA to decrypt an HTTPS connection under a transparent redirection deployment?

  1. The router must run WCCPv1.
  2. The WSA must be deployed in explicit proxy mode only.
  3. The client must trust the certificate authority that issued the WSA's generated certificate. Correct answer.
  4. The client must have the WSA configured as its default gateway.

Explanation

When the WSA intercepts TLS, it presents a certificate signed by a CA it controls, so the client must trust that CA or the browser will show a certificate warning. The default gateway and WCCP version do not determine whether decryption succeeds.

Question 32Configure and verify proxy and transparent traffic redirection

A router redirects traffic to the WSA using WCCP, but the WSA returns traffic to the router instead of sending it directly to the destination. Which WCCP return method is in use?

  1. Direct return
  2. L2 return Correct answer.
  3. GRE return
  4. NAT return

Explanation

With L2 return, the WSA rewrites the destination MAC address back toward the router so the router forwards the packet to its final destination. GRE return encapsulates packets back to the router, and NAT return is not a standard WCCP method.

Question 33Configure and verify proxy and transparent traffic redirection

Which WSA interface is typically used for WCCP communication with the router?

  1. The interface facing the clients and router that carries the redirected traffic Correct answer.
  2. The management interface only
  3. The interface connected to the internet only
  4. A dedicated loopback interface

Explanation

WCCP registration and redirected traffic flow over the data interface that faces the router and clients, so that is where the WCCP service is enabled. The management interface is for administration, and the internet-facing interface handles outbound requests after processing.

Question 34Configure and verify proxy and transparent traffic redirection

An administrator wants to verify that the WSA is successfully registered with a WCCP router. Which action provides the most direct confirmation on the WSA?

  1. Checking the FTP proxy logs
  2. Checking the SMTP relay queue
  3. Checking the WCCP status page or CLI output for the registered cache-engine state Correct answer.
  4. Checking the DNS cache statistics

Explanation

The WSA reports WCCP registration state, including the router and service group it is joined to, on its WCCP status display or CLI. DNS, FTP, and SMTP statistics are unrelated to WCCP registration.

Question 35Configure and verify proxy and transparent traffic redirection

Which statement correctly distinguishes transparent redirection from explicit proxy deployment on the WSA?

  1. Neither requires client-side proxy settings.
  2. Both require client-side proxy settings.
  3. Transparent redirection requires client-side proxy settings, while explicit proxy does not.
  4. Explicit proxy requires client-side proxy settings, while transparent redirection does not. Correct answer.

Explanation

In explicit proxy deployment, the client must be configured to send requests to the WSA, either manually or through a PAC file. Transparent redirection intercepts traffic at the network layer so the client needs no proxy configuration.

Question 36Configure and verify proxy and transparent traffic redirection

A WSA is configured with WCCP, but clients can reach the internet directly without passing through the proxy. Which configuration issue is the most likely cause?

  1. The DNS server is set to an external address.
  2. The FTP proxy is disabled.
  3. The WSA hostname is too long.
  4. The redirect ACL does not match the client traffic. Correct answer.

Explanation

If the redirect ACL does not match the client traffic, the router forwards those packets normally and they bypass the WSA. Hostname length, DNS server choice, and FTP proxy state do not determine whether WCCP redirects web traffic.

Question 37Configure and verify proxy and transparent traffic redirection

Which WSA setting controls whether the appliance accepts traffic redirected by PBR as transparent traffic?

  1. The transparent redirection setting on the data interface Correct answer.
  2. The FTP proxy port
  3. The SMTP relay setting
  4. The DNS forwarding setting

Explanation

The WSA must be told that the data interface receives transparently redirected traffic; otherwise packets sent by PBR may not be handled as intended. SMTP, DNS, and FTP settings do not affect how redirected web traffic is treated.

Question 38Configure and verify proxy and transparent traffic redirection

Which protocol and port does WCCP use between the router and the cache engine for control messages?

  1. UDP port 2048 Correct answer.
  2. TCP port 2048
  3. TCP port 8080
  4. UDP port 443

Explanation

WCCP control messages are exchanged over UDP port 2048 between the router and the cache engine. TCP 2048, UDP 443, and TCP 8080 are not the WCCP control channel.

Question 39Configure and verify proxy and transparent traffic redirection

Which WCCP service group identifier is commonly used for standard HTTP web caching redirection?

  1. Service group 0 (web-cache) Correct answer.
  2. Service group 99
  3. Service group 443
  4. Service group 2048

Explanation

WCCP service group 0, known as web-cache, is the standard service used to redirect HTTP traffic to a caching proxy. The other numbers are not the conventional web-cache service group.

Question 40Configure and verify proxy and transparent traffic redirection

When a WSA uses WCCP with L2 redirect, where does the WSA send the response to the client?

  1. Directly to the client, using the client's MAC address Correct answer.
  2. To the management interface
  3. Back through the router in all cases
  4. To the origin server only

Explanation

With L2 redirect, the WSA can return responses directly to the client at Layer 2 because it learns the client's MAC address. Traffic is not forced back through the router, and the management interface is not used for data return.

Question 41Configure and verify proxy and transparent traffic redirection

Which statement about using PBR for transparent redirection is true?

  1. PBR requires WCCP to be enabled on the WSA.
  2. PBR redirects all traffic regardless of ACLs.
  3. PBR requires the WSA to be the default gateway for clients.
  4. PBR can redirect traffic based on ACL matches such as source subnet or destination port. Correct answer.

Explanation

PBR uses route maps with match ACLs, so administrators can choose which source subnets, destination ports, or protocols are redirected to the WSA. PBR does not require the WSA to be the default gateway, and it works independently of WCCP.

Question 42Configure and verify proxy and transparent traffic redirection

A client is configured to use the WSA as an explicit proxy. Which behavior indicates that the client is not sending traffic to the proxy?

  1. The client can browse websites without any corresponding entries in the WSA access logs. Correct answer.
  2. The client receives a proxy authentication prompt.
  3. The client's requests appear in the WSA access logs.
  4. The WSA shows active proxy connections from the client.

Explanation

If the client bypasses the proxy, the WSA never sees the requests, so its access logs show nothing for that client. Proxy authentication prompts and logged connections indicate the client is using the proxy.

Question 43Configure and verify proxy and transparent traffic redirection

Which WSA feature should be configured so that transparently redirected HTTPS traffic is not dropped when the client does not trust the WSA's certificate authority?

  1. Configure WCCPv1
  2. Enable the FTP proxy
  3. Deploy the WSA's root CA certificate to the client trust store Correct answer.
  4. Disable the HTTPS proxy entirely

Explanation

Clients must trust the CA that signs the certificates the WSA generates during HTTPS inspection; otherwise they reject the connection. Disabling the HTTPS proxy, enabling FTP, or using WCCPv1 does not solve the trust problem.

Question 44Configure and verify proxy and transparent traffic redirection

Which two pieces of information does a client need to use an explicit proxy on the WSA? (Choose the best answer.)

  1. The router's redirect ACL and next hop
  2. The proxy IP address and the proxy port Correct answer.
  3. The WCCP service group and password
  4. The origin server's IP address and MAC address

Explanation

An explicit proxy client must know the proxy's IP address and listening port to send requests to it. WCCP service groups, origin server addresses, and router ACLs are relevant to transparent redirection, not to explicit client configuration.

Question 45Configure and verify proxy and transparent traffic redirection

An administrator observes that WCCP redirection works for HTTP but HTTPS traffic from clients is not reaching the WSA. Which explanation is most plausible?

  1. The DNS cache is full.
  2. The FTP proxy is disabled.
  3. The WCCP redirect ACL is matching only TCP port 80, so port 443 traffic is not redirected. Correct answer.
  4. The WSA hostname is not resolvable.

Explanation

WCCP redirects only the traffic permitted by the redirect ACL; if the ACL matches just port 80, HTTPS on port 443 bypasses the WSA. Hostname resolution, FTP proxy state, and DNS cache size do not determine whether HTTPS is redirected.

Question 46Configure and verify proxy and transparent traffic redirection

A network engineer is deploying the WSA as a transparent proxy and plans to use PBR on the core router instead of WCCP. Which statement describes how PBR redirects client traffic to the WSA?

  1. The router encapsulates matching packets in a GRE tunnel terminated on the WSA's data interface.
  2. The router rewrites the destination IP address of matching packets to the WSA's proxy interface address.
  3. The router forwards matching packets to the WSA's next hop while preserving the original destination address. Correct answer.
  4. The router answers ARP requests on behalf of the WSA and rewrites the destination MAC address.

Explanation

PBR matches traffic with a route map and sets the next hop to the WSA, so the packet arrives with its original destination IP intact and the WSA treats it as transparently redirected traffic. The WSA must therefore have a route back toward the clients and must accept redirected traffic on the correct interface. Address rewriting and GRE encapsulation are not part of PBR redirection.

Question 47Configure and verify proxy and transparent traffic redirection

Clients are being redirected to the WSA by WCCP and the appliance is receiving their HTTP requests. Users report that every request fails and the WSA logs show the proxy cannot resolve any external hostnames. Which configuration should the administrator verify first?

  1. The HTTPS decryption policy applied to the identity group.
  2. The transparent redirection setting on the data interface.
  3. The WCCP service group password shared with the router.
  4. The DNS server settings used by the WSA for its own lookups. Correct answer.

Explanation

When the WSA acts as a proxy it resolves destination hostnames itself, so its own DNS configuration must point to reachable resolvers regardless of how clients were redirected. A working WCCP registration and redirection only prove traffic arrives; they do not give the appliance name resolution. Checking the appliance's DNS settings is therefore the first step.

Question 48Configure and verify proxy and transparent traffic redirection

A WSA is registered with a WCCP router for the standard web-cache service, and clients' HTTP traffic is being redirected. The administrator now needs HTTPS traffic from the same clients to reach the WSA for decryption, using the same router. What is required on the WSA side?

  1. Enable the HTTPS Proxy on a separate port and add the WSA to a second WCCP service group that redirects TCP 443. Correct answer.
  2. Enable SSL decryption in the access log and rely on the web-cache service group to carry port 443 traffic.
  3. Configure the router to send port 443 traffic to the WSA using the same web-cache service group identifier.
  4. Change the existing web-cache service group so it redirects all TCP ports instead of only port 80.

Explanation

The standard web-cache service group (service ID 0) only covers TCP port 80, so HTTPS cannot ride along on it. To intercept port 443 transparently the WSA must have the HTTPS Proxy enabled and be registered in an additional WCCP service group configured to redirect TCP 443. The router must then be configured to match that second service group.

Question 49Configure authentication, identity, and access policies

On a Cisco Secure Web Appliance, which authentication service is used by default to validate user credentials when an LDAP authentication realm is configured but no external authentication server is reachable?

  1. Kerberos constrained delegation to the domain controller
  2. A RADIUS server configured under the external authentication settings
  3. The TACACS+ server defined in the AAA configuration
  4. The appliance's local user database Correct answer.

Explanation

When an authentication realm cannot contact its configured external server, the appliance falls back to its local user database, which is always consulted for administrative and, if enabled, end-user authentication. The local database is built in and does not depend on network reachability. RADIUS, TACACS+, and Kerberos are only used when explicitly configured and reachable.

Question 50Configure authentication, identity, and access policies

An administrator wants the appliance to identify users transparently as they browse, without prompting for credentials, using the existing Active Directory domain. Which feature should be configured?

  1. Explicit forward proxy authentication with basic credentials
  2. Transparent user identification using the identity services engine or NTLM Correct answer.
  3. SAML 2.0 single sign-on with the appliance as the identity provider
  4. Client certificate authentication with OCSP validation

Explanation

Transparent user identification relies on mechanisms such as NTLM or an external identity engine to map an IP address or session to a directory user without a credential prompt. It is designed for seamless identification against Active Directory. Explicit proxy authentication and SAML both require some form of user interaction or redirect.