Which response code in the access logs indicates that a transaction was blocked due to policy?

In Cisco Web Security Appliance (WSA) access logs, the result code TCPDENIED/403 indicates that a transaction was blocked due to a configured policy. The TCPDENIED portion signifies the action taken by the WSA—denying the request. The 403 is the standard HTTP status code for "Forbidden," which is returned to the client when the proxy understands the request but refuses to fulfill it based on an access policy, such as a blocked URL category, a denied application, or other access control rules.

A. TCPDENIED/407 specifically indicates that the transaction was denied because proxy authentication is required and was not provided or was incorrect.
B. TCPDENIED/401 is an invalid combination for a proxy-level block. The HTTP 401 "Unauthorized" status is sent by the origin web server, whereas a proxy uses 407 for authentication challenges.
D. TCPDENIED/307 is logically incorrect. The HTTP 307 status code signifies a "Temporary Redirect," which is a redirection action, not a block or denial.

1. Cisco. (2021). Cisco Web Security Appliance Best Practices Guide. In the "Logging" section, it is detailed that access logs provide visibility into web traffic. The result code TCPDENIED/403 is explicitly used to represent traffic that is blocked by an access policy. (Reference: Section on "Logging and Reporting").

2. Cisco. (2022). AsyncOS 14.5 for Cisco Web Security Appliances User Guide. In the chapter "Monitoring System Activity and Performance," the "Access Logs" subsection describes the log file format. It specifies that the result code field indicates how a transaction was resolved. The guide provides examples where TCPDENIED/403 is the result of a request being blocked by an Access Policy. (Reference: Chapter 12, "Using Log Files," section "Access Logs," subsection "Result Codes").

3. Cisco. (2023). WSA Access Logs Format and Result Codes. This official documentation article lists and explains the various disposition and HTTP status codes. It clarifies that TCPDENIED is a disposition for blocked transactions and 403 is the status for a forbidden request, commonly resulting from policy enforcement. (Reference: Document ID: 118093, section "Result Codes").