Which statement about Cisco Advanced Web Security Reporting integration is true?

Cisco Advanced Web Security Reporting (AWSR), typically hosted on a Security Management Appliance (SMA), retrieves log files from one or more Web Security Appliances (WSA). To manage disk space on the source WSA, the log subscription on the WSA can be configured to delete log files after they have been successfully retrieved and indexed by the AWSR system. This is a standard feature to prevent the WSA's local storage from filling up with old log data that has already been archived centrally.

A. AWSR uses the configured appliance name or serial number as a unique identifier, not just the IP address, which can be non-static.
B. Advanced Web Security Reporting is a licensed feature. A specific software license is required on the Security Management Appliance (SMA) to enable this functionality.
D. AWSR is deployed as a dedicated physical or virtual appliance (using an OVA template on a hypervisor like VMware ESXi), not as a software package installed on standard Windows or Red Hat Linux operating systems.

1. Correct Answer (C): Cisco AsyncOS 14.0 for Web User Guide, "Log Subscriptions" chapter, section "Rollover and Deletion." The guide states, "For FTP on Pull and SCP on Pull retrieval methods, you can choose the action that the Security Appliance takes after the file is retrieved: Rename the file... or Delete the file." This confirms that the system can be configured to remove log files after retrieval by a reporting system like AWSR.

2. Incorrect Answer (B): Cisco Content Security Management Appliance (SMA) Data Sheet. Under "Software Licenses for Cisco SMA," the document lists "Advanced Web Security Reporting" as a separately licensed feature. For example, the part number for a 1-year subscription for up to 999 users is SMA-WREP-1Y-S1.

3. Incorrect Answer (D): Cisco Content Security Virtual Appliance Installation Guide. The guide details the installation process, which involves deploying a .ova file on a supported hypervisor (VMware ESXi or KVM). It does not describe an installation procedure for Windows or as a standard package on Red Hat Enterprise Linux. (See "Deploying the Virtual Appliance" section).