5.5 Web Filtering, User Identification, and Application Visibility and Control (AVC) on Cisco FTD and Cisco WSA CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses Cisco FTD. They want to block access to malicious websites based on reputation scores, but allow access to low-risk sites. They also want to ensure that users are identified for auditing. Which FTD feature should they use?

   • AConfigure a DNS sinkhole for malicious domains and use a captive portal.
   • BURL filtering with reputation-based conditions, combined with an identity policy using Active Directory.
   • CSecurity Intelligence using IP reputation lists, and rely on IP-based logging.
   • DUse AVC to block malicious applications, and use passive authentication.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A law firm uses Cisco WSA. They want to block access to file-sharing websites and also prevent users from uploading sensitive documents to cloud storage services. They need to identify users by their AD credentials. Which WSA features should they combine?

   • AUse AVC to block all cloud storage and rely on IP-based logging.
   • BConfigure an acceptable use policy (AUP) and use transparent user identification.
   • CUse only URL filtering to block both file-sharing and cloud storage domains.
   • DURL filtering to block file-sharing sites, AVC to control cloud storage applications, and Active Directory integration for user identification.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company uses Cisco FTD and wants to enforce web filtering based on user identity. They have a mix of domain-joined and non-domain-joined devices. They want to ensure that users on non-domain-joined devices are prompted to authenticate, while domain-joined users are automatically identified. Which configuration should they use?

   • AUse IP-based identification for all devices.
   • BEnable Active Directory realm with passive authentication for domain-joined devices, and configure a captive portal for non-domain-joined devices.
   • CUse only captive portal for all users.
   • DUse only passive authentication for all devices.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A retail company uses Cisco WSA. They want to allow employees to access social media during lunch breaks but block it during working hours. They also want to ensure that only authenticated users can access the internet. Which WSA configuration is most appropriate?

   • AUse IP-based identification and allow social media for all users.
   • BUse transparent user identification and block social media for all users.
   • CUse explicit authentication with AD credentials and create time-based web access policies for social media.
   • DConfigure a single web access policy that blocks social media during working hours and allows it otherwise, without authentication.
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A company uses Cisco FTD. They have a policy to allow the use of web-based email (e.g., Gmail, Outlook) but block the ability to send attachments via webmail to prevent data leakage. They also need to enforce this policy only for users in the 'Finance' department. The network has a mix of domain-joined and non-domain-joined devices. Which FTD configuration is most effective?

   • AUse a captive portal to authenticate all users and then apply a URL filtering rule based on user role.
   • BUse URL filtering to block the attachment URLs of webmail services, and apply the rule to all users.
   • CCreate a prefilter rule to block all webmail traffic for the Finance department.
   • DUse AVC to identify webmail applications and block the 'send attachment' sub-application, and scope the rule to the Finance AD group using an identity policy with Active Directory.
   Reveal Solution Discussion Select an answer first