5.5 Web Filtering, User Identification, and Application Visibility and Control (AVC) on Cisco FTD and Cisco WSA CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which user identification method on Cisco WSA automatically identifies users without requiring them to log in?

   • ATransparent user identification
   • BExplicit authentication
   • CCaptive portal
   • DRADIUS authentication
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is deploying Cisco FTD as their internet gateway. They want to block access to gambling sites for all users, but allow access to social media during lunch hours only. They also need to ensure that users are identified by their Active Directory username for logging. Which configuration approach on FTD will meet these requirements with the least administrative overhead?

   • AImplement a security intelligence feed for gambling and use a RADIUS server for user authentication.
   • BUse a prefilter policy to block gambling and a separate access control rule for social media with a time range, and rely on passive authentication.
   • CConfigure a DNS sinkhole for gambling domains and use an identity policy with captive portal for all users.
   • DConfigure a URL filtering rule with a category condition for gambling and a time-based rule for social media, and enable Active Directory realm for user identification.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A university uses Cisco WSA. They want to allow social media for students but block it for faculty during working hours. They also want to monitor and control the use of peer-to-peer (P2P) file sharing applications. The university has a large number of users and wants to minimize authentication overhead. Which WSA configuration is most appropriate?

   • AUse IP-based identification and block social media for all users during working hours.
   • BUse explicit authentication for all users to ensure accurate identity, and create policies based on user groups.
   • CUse transparent user identification with Active Directory to identify users, and create separate web access policies for students and faculty with time-based restrictions for social media, and use AVC to block P2P applications.
   • DConfigure a single web access policy that blocks social media for everyone and uses URL filtering to block P2P sites.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A multinational company has Cisco FTD at each branch office and a centralized Cisco WSA in the data center. They want to enforce consistent web filtering policies across all branches, but they also want to allow local branches to have some flexibility. They are concerned about WAN bandwidth if all web traffic is tunneled to the data center. Which deployment strategy is most effective?

   • AUse FTD's AVC to control all web traffic and disable WSA entirely.
   • BUse FTD's local URL filtering for initial reputation checks and redirect only uncategorized or high-risk traffic to the central WSA for detailed inspection.
   • CSend all web traffic from branch FTDs to the central WSA via a VPN tunnel.
   • DDeploy a WSA at each branch office to avoid WAN traffic.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security architect is choosing between Cisco FTD and Cisco WSA for a new deployment. The organization needs deep application-level control (e.g., blocking specific features within applications), granular user-based web policies, and detailed reporting on web usage. They also have a limited budget and prefer a single appliance. Which solution should they choose?

   • ANeither, use a cloud-based web security service instead.
   • BCisco FTD, because it provides integrated AVC and URL filtering with user identification, and can act as the primary gateway.
   • CBoth FTD and WSA in series, to get the best of both worlds.
   • DCisco WSA, because it provides more granular web filtering and reporting than FTD.
   Reveal Solution Discussion Select an answer first