300-725 Practice Questions

A Cisco Web Security Appliance (WSA) Decryption Policy is designed to handle HTTPS traffic by making a decision on whether to intercept it for inspection. The two primary actions available within these policies are 'Decrypt' and 'Pass Through'. The 'Decrypt' action instructs the WSA to perform TLS/SSL interception, decrypt the traffic for inspection by other security engines, and then re-encrypt it. The 'Pass Through' action allows the encrypted traffic to bypass decryption and inspection, which is essential for sensitive categories like financial services or for applications that use certificate pinning and would otherwise fail.

B. Warn: This is an action available in Access Policies to present a warning page to the user, not a valid action within a Decryption Policy.

D. Allow: This is a general term and a specific action in Access Policies. In Decryption Policies, the actions for permitted traffic are more specific ('Decrypt' or 'Pass Through').

E. Block: While 'Drop' (the equivalent of Block) is a valid action in a Decryption Policy, 'Decrypt' and 'Pass Through' are the two fundamental, non-terminating actions that define the policy's primary purpose.

1. Source: Cisco Web Security Appliance AsyncOS 15.0 User Guide

Reference: Chapter 11

"Managing Decryption Policies

" Section: "Actions in Decryption Policy Rules

" Page 11-6.

Quote: "For each policy rule

you can configure one of the following actions to be taken on traffic that matches the rule criteria: Decrypt

Pass Through

Drop." (This confirms that 'Decrypt' and 'Pass Through' are primary actions. 'Drop' is the equivalent of 'Block').

2. Source: Cisco Web Security Appliance Configuration Guide - Configure HTTPS Inspection

Reference: Section "Configure Decryption Policies"

Details: The configuration steps and screenshots in this official guide consistently show the available actions for a decryption policy rule as "Decrypt

" "Pass Through

" and "Drop." This distinguishes them from Access Policy actions like "Allow

" "Warn

" or "Block" (though Drop has the same effect as Block).

The Cisco Web Security Appliance (WSA) processes access policy elements in a specific, logical order. First, it identifies the destination by checking URL categories, with user-defined custom URL categories taking precedence over the predefined URL category database. Once the URL is permitted, the WSA uses Application Visibility and Control (AVC) to identify the specific web application via the application filter. If the application is allowed, the WSA then inspects the content's file type using the MIME type filter. Finally, if the content is permitted by all preceding policies, it undergoes security scanning for threats, such as malware scanning, before being delivered to the end-user. This sequence ensures efficient and layered policy enforcement.

Cisco AsyncOS 15.0 for Web User Guide:

Section: "About Policies," sub-section "How Policies Are Applied to Client Requests." This section details the hierarchical structure of policy evaluation. It explains that URL categorization is one of the initial checks within an Access Policy. The documentation implicitly supports the precedence of custom categories as they are user-defined overrides.

Section: "Controlling Web Applications with Application Visibility and Control." This chapter describes how AVC (application filtering) is applied after initial URL filtering is complete.

Section: "Scanning for Viruses and Malware." This part of the documentation clarifies that anti-malware scanning is a content security service applied to traffic that has already been permitted by access and decryption policies.

Cisco Live Presentation BRKSEC-3303 - Advanced Web Security with Cisco WSA:

The presentation slides on "WSA Policy Engine" and "Order of Operations" explicitly show the flow of a web request through the WSA. The diagrams confirm that URL lookups (custom and predefined) occur first, followed by application controls (AVC), object filtering (MIME types), and then security services like Advanced Malware Protection (AMP) and anti-virus scanning. This source provides a visual and sequential confirmation of the answer.

Cisco Advanced Malware Protection (AMP) for Web Security enhances the capabilities of the Cisco WSA beyond traditional signature-based scanning engines (like Sophos or McAfee). AMP's primary advantage is its ability to combat advanced threats. It uses file reputation, sandboxing via Cisco Threat Grid for dynamic analysis of unknown files, and retrospective security. This architecture is specifically designed to identify and block previously unseen, or "zero-day," attacks. It is also highly effective against targeted file-based attacks, which often employ custom malware crafted to evade conventional signature-based defenses.

A. protection against malware: This is too generic. Traditional antivirus engines also provide protection against known malware, making this not a comparative benefit of AMP.

C. protection against spam: This is not a function of AMP. Spam filtering is handled by dedicated anti-spam engines or email security appliances.

D. protection against viruses: This is a basic capability of all antivirus/antimalware engines on the WSA, not a unique advantage of AMP.

1. Cisco Web Security Appliances User Guide

AsyncOS 14.5

Chapter: Protecting Against Malware and Malicious or Unwanted Content

Section: About Advanced Malware Protection.

"Advanced Malware Protection (AMP) helps to detect and block malware in files downloaded from the web... It is particularly effective against targeted and zero-day attacks." This statement directly supports options B and E as the key differentiators.

2. Cisco Web Security Appliance Best Practices Guide

Section: Advanced Malware Protection (AMP).

"Traditional anti-malware solutions are based on point-in-time detection... However

advanced malware can often evade this initial detection... AMP provides protection across the attack continuum... before

during

and after an attack... by using continuous analysis and retrospective security." This explains the mechanism by which AMP addresses advanced threats like zero-day and targeted attacks

which other engines miss.

3. Cisco Content Security Management Appliance Configuration Guide

14.0

Chapter: File Reputation and Analysis

Section: File Analysis.

"File analysis provides advanced threat detection of unknown files by executing them in a sandbox and analyzing their behavior to determine the file’s threat level." This describes the sandboxing capability used to identify the malicious behavior characteristic of zero-day attacks.

An identification profile on the Cisco Web Security Appliance (WSA) is used to identify users and map them to policies. A key feature is the ability to identify users based on criteria other than credentials, such as IP address. Therefore, an administrator can explicitly configure an identification profile to use "No Authentication." This is a common configuration for creating policies for guest users or for traffic from specific subnets where user-level authentication is not required or feasible. This flexibility is a fundamental aspect of how identification profiles function.

B. The Guest identification profile, typically a catch-all for unauthenticated users, should be processed last to allow more specific, authenticated profiles to be matched first.

C. An identification profile can be associated with multiple user groups from a single authentication realm, allowing for granular policy application to various sets of users.

D. AsyncOS processes identification profiles in the order they are listed in the configuration table (top-down), which is manually configurable by the administrator, not alphabetically.

1. Cisco Web Security Appliance Configuration Guide

14.0: In the chapter "Identities and User Identification

" the section "How the Web Security Appliance Identifies Users" explains the processing order. It states

"AsyncOS for Web evaluates identification profiles in the order that they are listed in the table on the Identification Profiles page." This refutes options B and D.

2. Cisco Web Security Appliance Configuration Guide

14.0: In the same chapter

the section "Creating a Custom Identification Profile" details the configuration steps. Step 6 in the "Procedure" subsection shows the option to select an "Authentication Realm" or choose "No Authentication

" which directly supports option A.

3. Cisco Web Security Appliance Configuration Guide

14.0: The section "Creating a Custom Identification Profile" also shows that when an authentication realm is selected

an administrator can select one or more user groups to apply the profile to. This directly refutes option C. The guide states

"Select the user groups to which this profile applies." The interface allows for multiple selections.

Explicit forward mode deployment requires client applications, such as web browsers, to be explicitly configured to send web traffic to the proxy. A Proxy Auto-Config (PAC) file is a common and scalable method for this configuration. The PAC file contains JavaScript logic that instructs the browser which proxy to use for a given URL, or whether to connect directly. This client-side configuration is the defining characteristic of an explicit deployment.

B. WCCP: Web Cache Communication Protocol (WCCP) is a network-level protocol used to transparently redirect traffic to a proxy without any client-side configuration.

C. ITD: Intelligent Traffic Director (ITD) is a Cisco Nexus feature for transparently load-balancing and redirecting traffic to a group of appliances, which is a transparent deployment method.

D. PBR: Policy-Based Routing (PBR) is a technique used on routers and switches to transparently forward traffic to a specific next-hop (like a proxy) based on defined policies.

1. Cisco Web Security Appliance Best Practices Guide. (2018). Cisco Systems

Inc. In the "Deployment Modes" section

it states

"In explicit forward mode

you must configure user agent applications (such as web browsers) to send requests directly to the Web Security appliance... You can use a Proxy Auto-Configuration (PAC) file to direct user agents to the correct proxy." (Page 10).

2. AsyncOS 14.5 for Cisco Web Security Appliances User Guide. (2022). Cisco Systems

Inc. The section "Deployment Modes for the Web Proxy" describes Explicit Forward Mode: "You must configure client web browsers to send HTTP and HTTPS requests to the Web Security appliance." It later details using PAC files for this purpose under "Using PAC Files to Direct Web Traffic." (Chapter: The Web Proxy

Page 1-3).

3. Configuring Web Cache Services Using WCCP. (2023). Cisco Systems

Inc. This document describes WCCP as a technology for transparent redirection: "WCCP enables you to transparently redirect traffic that is destined for a specific device." (Introduction section).

The provided access log entry contains a field dedicated to policy and reputation details. Within this field, the string DEFAULTCASE12-AnalyzeSuspectTraffic-DefaultGroup... is clearly visible. This string is a trace of the policy evaluation for the transaction, explicitly indicating that a policy group named AnalyzeSuspectTraffic was matched and its rules were applied to this specific web request. The other statements are contradicted by the information present in the log.

A. The log begins with the Unix epoch timestamp 1603831349.481, which corresponds to a specific date and time, making this statement false.

B. The result code TCPMISS explicitly means the requested object was not found in the proxy's cache, forcing a connection to the origin server.

C. The URL http://www.example.com/ uses the standard HTTP protocol, which defaults to TCP destination port 80, not 8187.

1. Cisco

User Guide for AsyncOS 14.0 for Cisco Web Security Appliances

"Log Files

" "Access Logs

" p. 14-4

14-8. This guide details the access log format. It confirms the first field is a Unix timestamp. It also defines the TCPMISS result code as "The appliance did not have the requested object in its cache." The policy trace is a custom field (%p) that shows the policy group applied.

2. Cisco

Cisco Web Security Appliance Best Practices Guide

"Logging

" "Access Logs

" p. 23. This document explains that the access logs are the primary source for troubleshooting policy application. It highlights that the policy trace field is used to "verify which policy is being applied to the traffic

" confirming that the presence of AnalyzeSuspectTraffic in the log means that policy was applied.

The solution correctly categorizes the methods based on how client traffic is directed to the Cisco Web Security Appliance (WSA).

• Transparent Mode intercepts web traffic without requiring any configuration on the end-user's client machine. The network infrastructure redirects the traffic. WCCP (Web Cache Communication Protocol) and PBR (Policy-Based Routing) are network-level technologies used on routers or Layer 3 switches to transparently forward specific traffic (like HTTP/HTTPS) to the WSA.
• Explicit Mode requires the client application (e.g., a web browser) to be explicitly configured to use the WSA as a proxy. A PAC (Proxy Auto-Configuration) file is a script that tells a browser where to send web requests. WPAD (Web Proxy Auto-Discovery Protocol) is a method that allows browsers to automatically discover the location of a PAC file, thus falling under the explicit configuration umbrella.

Cisco, AsyncOS 14.5 for Cisco Secure Web Appliance User Guide.

Section: "Deployment > Network Deployment Options > How the Secure Web Appliance Fits in the Network". This section describes the two primary deployment modes. It states, "In an explicit forward deployment, you configure client browsers to send traffic directly to the Secure Web Appliance... In a transparent deployment, the Secure Web Appliance is placed in the network in a way that it intercepts traffic as the traffic is routed through the network."

Cisco, Cisco Web Security Appliance Best Practices Guide.

Section: "Deployment > Transparent or Explicit Deployment". This guide details the methods for each mode. For transparent deployments, it specifies, "Transparently redirecting traffic to the web security appliance with a router that is configured for Web Cache Communication Protocol (WCCP) or with policy-based routing (PBR)..." For explicit deployments, it states, "In explicit deployment, user agents (typically web browsers) are configured to send their requests directly to the WSA... The primary methods of configuring the user agent are: Manual configuration, Proxy auto-config (PAC) files, Web Proxy Autodiscovery Protocol (WPAD)."

In Cisco Web Security Appliance (WSA) access logs, the result code TCPDENIED/403 indicates that a transaction was blocked due to a configured policy. The TCPDENIED portion signifies the action taken by the WSA—denying the request. The 403 is the standard HTTP status code for "Forbidden," which is returned to the client when the proxy understands the request but refuses to fulfill it based on an access policy, such as a blocked URL category, a denied application, or other access control rules.

A. TCPDENIED/407 specifically indicates that the transaction was denied because proxy authentication is required and was not provided or was incorrect.

B. TCPDENIED/401 is an invalid combination for a proxy-level block. The HTTP 401 "Unauthorized" status is sent by the origin web server, whereas a proxy uses 407 for authentication challenges.

D. TCPDENIED/307 is logically incorrect. The HTTP 307 status code signifies a "Temporary Redirect," which is a redirection action, not a block or denial.

1. Cisco. (2021). Cisco Web Security Appliance Best Practices Guide. In the "Logging" section

it is detailed that access logs provide visibility into web traffic. The result code TCPDENIED/403 is explicitly used to represent traffic that is blocked by an access policy. (Reference: Section on "Logging and Reporting").

2. Cisco. (2022). AsyncOS 14.5 for Cisco Web Security Appliances User Guide. In the chapter "Monitoring System Activity and Performance

" the "Access Logs" subsection describes the log file format. It specifies that the result code field indicates how a transaction was resolved. The guide provides examples where TCPDENIED/403 is the result of a request being blocked by an Access Policy. (Reference: Chapter 12

"Using Log Files

" section "Access Logs

" subsection "Result Codes").

3. Cisco. (2023). WSA Access Logs Format and Result Codes. This official documentation article lists and explains the various disposition and HTTP status codes. It clarifies that TCPDENIED is a disposition for blocked transactions and 403 is the status for a forbidden request

commonly resulting from policy enforcement. (Reference: Document ID: 118093

section "Result Codes").

The Cisco Web Security Appliance (WSA) uses port 3128 as the default TCP port for the explicit forward web proxy service. When end-user browsers are configured to send web traffic to the WSA, they must be pointed to the IP address or hostname of the WSA and configured to use port 3128. This port is the standard listening port on the WSA's P1 (Proxy 1) interface for intercepting and inspecting HTTP and HTTPS requests from clients. While administrators can configure other ports, 3128 is the default setting.

B. 8443: This is the default port for accessing the WSA's graphical user interface (GUI) for management over a secure HTTPS connection.

C. 8021: This port is not used by default for any primary service on the Cisco WSA.

1. Cisco. (2021). AsyncOS 14.0 for Cisco Web Security Appliances - User Guide. "Configuring Web Proxy Listeners" section

Page 10-1. The guide states

"By default

the P1 interface on the appliance is enabled and the web proxy listens for proxy requests on port 3128 on all IP addresses associated with this interface."

2. Cisco. (2017). Cisco Web Security Appliance Best Practices Guide. "Deployment" section

"Explicit Forward Deployment

" Page 10. This document notes

"The default proxy port is 3128. If you change the port

you must update the browser settings on the client machines."

3. Cisco. (2021). AsyncOS 14.0 for Cisco Web Security Appliances - CLI Reference Guide. "proxyconfig" command details

Page 20-208. The documentation for the proxyconfig > setup command shows that the default port presented for the proxy is 3128.

When a new custom URL category is created on the Cisco Secure Web Appliance (WSA), its default action within all existing Access Policies is set to Monitor. This design choice prevents the unintentional blocking of potentially critical web traffic. The "Monitor" action permits the traffic to proceed to its destination but ensures that all transactions matching the new category are logged. This provides administrators with visibility into the traffic patterns, allowing them to make an informed decision later whether to change the action to "Allow" or "Block" based on the observed activity.

B. allow: While "Monitor" does allow traffic, it specifically includes logging for review. "Allow" is a distinct action that does not imply this default level of scrutiny for a new category.

C. block: Blocking a new, un-evaluated category by default would be disruptive and could inadvertently deny access to necessary resources, violating the principle of least disruption.

D. decrypt: Decryption is an action configured within Decryption Policies to inspect encrypted traffic, not the default access control action for a URL category in an Access Policy.

1. Cisco Web Security Appliance User Guide

AsyncOS 14.0

Chapter: Controlling Web Access

Section: URL Filtering

Subsection: Actions for URL Categories.

"When you create a custom URL category

the default action for that category is Monitor in all access policies." This statement explicitly confirms the default behavior. The guide further explains that the Monitor action is intended for tracking traffic to specific categories without blocking it.

2. Cisco Web Security Appliance Configuration Guide

AsyncOS 15.0

Chapter: Access Policies

Section: Configuring URL Filtering.

The documentation details the process of adding categories to an access policy. It shows that for any newly defined category

the initial state in the policy matrix is "Monitor

" which an administrator must then consciously change to "Allow

" "Block

" or another action. This default ensures visibility without immediate impact.