5.5 Web Filtering, User Identification, and Application Visibility and Control (AVC) on Cisco FTD and Cisco WSA CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A government agency uses Cisco WSA. They need to block access to social media for all users, but allow access to a specific social media site for the public affairs department. They also need to ensure that all web traffic is logged with usernames. The agency has a high-security requirement and wants to prevent any bypass. Which WSA configuration is most appropriate?

   • AUse IP-based identification and allow social media for the public affairs department based on IP range.
   • BUse transparent user identification and block social media for all users.
   • CUse explicit authentication with AD credentials, create a web access policy that blocks social media by default, and add an exception for the public affairs group to allow the specific site.
   • DConfigure a single web access policy that blocks social media and rely on the default policy for the exception.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A company has Cisco FTD and Cisco WSA. They want to use FTD to perform initial URL reputation filtering and block high-risk sites, while WSA handles detailed web filtering and acceptable use policies. They also want to ensure that users are identified consistently across both devices. Which integration approach is most effective?

   • APlace FTD and WSA in parallel, each handling different users, and synchronize policies manually.
   • BUse FTD's AVC to control all web traffic and disable WSA's filtering.
   • CConfigure FTD to block high-risk sites and have WSA use its own user identification method.
   • DConfigure FTD to redirect web traffic to WSA via WCCP, and use the same Active Directory realm on both devices for user identification.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A school district uses Cisco WSA as a forward proxy. They need to block social media for students but allow it for teachers. They also want to enforce safe search on search engines. Which WSA configuration will achieve this?

   • AImplement an acceptable use policy (AUP) that requires teachers to log in separately.
   • BUse URL filtering to block social media and rely on the default policy for teachers.
   • CCreate two web access policies: one for the students group blocking social media and enforcing safe search, and another for the teachers group allowing social media.
   • DConfigure a single web access policy that blocks social media for all users and enable safe search globally.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A security architect is evaluating Cisco FTD and Cisco WSA for a deployment. The organization needs to enforce web filtering based on user identity, control application usage, and provide detailed reporting. They have a large user base and want to minimize the number of appliances. They also need to support both on-premises and remote users. Which solution is most suitable?

   • ACisco WSA as a forward proxy for all users, including remote users via VPN.
   • BBoth FTD and WSA in series, with FTD at the perimeter and WSA as a proxy.
   • CCisco FTD with integrated AVC and URL filtering, using Active Directory for user identification, and deploying FTD at the perimeter and for remote users via VPN.
   • DUse a cloud-based web security service for all users.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial firm uses Cisco FTD. They want to allow the use of Microsoft Teams for business communication but block file sharing via Teams to prevent data leakage. They also need to log the username of each user. Which FTD feature set should be used?

   • AURL filtering to block Teams' file-sharing URLs and use passive authentication.
   • BConfigure a DNS sinkhole for Teams and use a captive portal for authentication.
   • CApplication Visibility and Control (AVC) with an application filter for Teams, and an identity policy with Active Directory.
   • DUse a prefilter policy to block Teams entirely and rely on IP-based logging.
   Reveal Solution Discussion Select an answer first