Which statement about identification profile default settings on the Cisco WSA is true?

An identification profile on the Cisco Web Security Appliance (WSA) is used to identify users and map them to policies. A key feature is the ability to identify users based on criteria other than credentials, such as IP address. Therefore, an administrator can explicitly configure an identification profile to use "No Authentication." This is a common configuration for creating policies for guest users or for traffic from specific subnets where user-level authentication is not required or feasible. This flexibility is a fundamental aspect of how identification profiles function.

B. The Guest identification profile, typically a catch-all for unauthenticated users, should be processed last to allow more specific, authenticated profiles to be matched first.
C. An identification profile can be associated with multiple user groups from a single authentication realm, allowing for granular policy application to various sets of users.
D. AsyncOS processes identification profiles in the order they are listed in the configuration table (top-down), which is manually configurable by the administrator, not alphabetically.

1. Cisco Web Security Appliance Configuration Guide, 14.0: In the chapter "Identities and User Identification," the section "How the Web Security Appliance Identifies Users" explains the processing order. It states, "AsyncOS for Web evaluates identification profiles in the order that they are listed in the table on the Identification Profiles page." This refutes options B and D.

2. Cisco Web Security Appliance Configuration Guide, 14.0: In the same chapter, the section "Creating a Custom Identification Profile" details the configuration steps. Step 6 in the "Procedure" subsection shows the option to select an "Authentication Realm" or choose "No Authentication," which directly supports option A.

3. Cisco Web Security Appliance Configuration Guide, 14.0: The section "Creating a Custom Identification Profile" also shows that when an authentication realm is selected, an administrator can select one or more user groups to apply the profile to. This directly refutes option C. The guide states, "Select the user groups to which this profile applies." The interface allows for multiple selections.