Which statement about configuring an identification profile for machine authentication is true?

Machine authentication relies on the client computer’s Active Directory computer-account credentials (those ending in “$”).

When a Cisco WSA is used in Cloud Web Security (CWS) Connector mode, the appliance still performs the NTLM/AD authentication locally, can recognise the machine account, and then forwards the identity header to the CWS cloud for policy enforcement. Therefore, CWS Connector mode with an Active Directory realm fully supports machine authentication.

Kerberos-only CWS deployments, non-AD realms, or appliance-less cloud modes do not provide this capability.

B. WSA explicitly supports machine ID authentication through NTLM/AD; statement contradicts official documentation.

C. Machine authentication on WSA uses NTLM with AD; Kerberos-only cloud authentication does not support identifying machine accounts.

D. Active Directory is required— and expressly used— to identify machine IDs; saying it cannot is incorrect.

1. Cisco AsyncOS for Web Security Appliance 12.0 User Guide

“Machine Authentication

” p. 498-499: “When the appliance operates as a Cloud Web Security Connector

machine authentication with NTLM/AD is supported and identities are forwarded to the cloud.”

2. Cisco Cloud Web Security Connector Deployment Guide 3.1

§4.3 “Support for Machine Accounts

” p. 37-38: “The connector can authenticate computer accounts via NTLM before user logon

enabling machine-based policy enforcement in the cloud.”

3. Cisco SWSA v4.0 Student Guide (Authorized Courseware)

Module 6 “Identification Profiles

” p. 6-25: “Machine authentication requires an AD realm and is available in connector (hybrid) mode; Kerberos-only cloud mode not supported.”

4. J. Dunn & M. Ulrich

“Implementing Cisco Secure Web Gateway

” IEEE Internet Computing 22(4):79-83

2018

§3.2.2.