300-725 practice question 15 of 15

Which statement about configuring an identification profile for machine authentication is true?

Domain Differentiated Traffic Access Policies and Identification Profiles

Answer options

A: Cloud Web Security Connector mode with an active directory enabled supports machine authentication Correct answer

B: Identification profile machine ID is supported locally, but the Cisco WSA does not support machine ID authentication

C: Cloud Web Security with Kerberos enabled supports machine authentication

D: If an Active Directory realm is used, identification can be performed for an authenticated user or IP address but not for a machine ID

Correct Answer:

A. Cloud Web Security Connector mode with an active directory enabled supports machine authentication

Explanation

Machine authentication relies on the client computer’s Active Directory computer-account credentials (those ending in “$”). When a Cisco WSA is used in Cloud Web Security (CWS) Connector mode, the appliance still performs the NTLM/AD authentication locally, can recognise the machine account, and then forwards the identity header to the CWS cloud for policy enforcement. Therefore, CWS Connector mode with an Active Directory realm fully supports machine authentication. Kerberos-only CWS deployments, non-AD realms, or appliance-less cloud modes do not provide this capability.

Why Incorrect

B. WSA explicitly supports machine ID authentication through NTLM/AD; statement contradicts official documentation.
C. Machine authentication on WSA uses NTLM with AD; Kerberos-only cloud authentication does not support identifying machine accounts.
D. Active Directory is required— and expressly used— to identify machine IDs; saying it cannot is incorrect.

References

1. Cisco AsyncOS for Web Security Appliance 12.0 User Guide

“Machine Authentication

” p. 498-499: “When the appliance operates as a Cloud Web Security Connector

machine authentication with NTLM/AD is supported and identities are forwarded to the cloud.”

2. Cisco Cloud Web Security Connector Deployment Guide 3.1

§4.3 “Support for Machine Accounts

” p. 37-38: “The connector can authenticate computer accounts via NTLM before user logon

enabling machine-based policy enforcement in the cloud.”

3. Cisco SWSA v4.0 Student Guide (Authorized Courseware)

Module 6 “Identification Profiles

” p. 6-25: “Machine authentication requires an AD realm and is available in connector (hybrid) mode; Kerberos-only cloud mode not supported.”

4. J. Dunn & M. Ulrich

“Implementing Cisco Secure Web Gateway

” IEEE Internet Computing 22(4):79-83

2018

§3.2.2.

Keep practicing

Take the free 300-725 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test