5.5 Web Filtering, User Identification, and Application Visibility and Control (AVC) on Cisco FTD and Cisco WSA CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A marketing agency uses Cisco WSA. They want to monitor and control the use of cloud storage applications like Dropbox and Google Drive. They also need to identify users by their AD credentials. Which WSA feature should they use?

   • AApplication Visibility and Control (AVC) with application policies, and integrate with Active Directory for user identification.
   • BConfigure a web access policy that blocks all cloud storage and use explicit authentication.
   • CURL filtering to block cloud storage domains and use IP-based authentication.
   • DUse the acceptable use policy (AUP) to restrict cloud storage and rely on transparent user identification.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An enterprise has both Cisco FTD and Cisco WSA in their network. They want to use FTD for initial URL reputation filtering and WSA for detailed web filtering and acceptable use policies. How should they integrate these devices for optimal security?

   • AUse FTD as the only web filter and disable WSA's filtering features.
   • BConfigure FTD to redirect web traffic to WSA using Policy-Based Routing (PBR) or WCCP, and have WSA enforce detailed web policies.
   • CConfigure WSA to send traffic to FTD for inspection, then back to WSA.
   • DPlace FTD and WSA in parallel, each handling different users, and synchronize policies manually.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small business with a single internet connection wants to implement web filtering with minimal hardware and management overhead. They have a limited budget and no dedicated proxy infrastructure. Which solution is most appropriate?

   • AImplement a free open-source proxy server instead.
   • BDeploy Cisco WSA as a forward proxy for all web traffic.
   • CUse Cisco FTD's built-in URL filtering and reputation-based controls.
   • DUse both FTD and WSA in series for layered filtering.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company uses Cisco FTD and wants to enforce web filtering based on user identity. They have a mix of domain-joined Windows machines and personal devices (BYOD). They want to avoid prompting users for credentials on their personal devices. Which user identification method should they use?

   • AUse captive portal for all users, requiring them to log in on every device.
   • BEnable Active Directory realm for domain-joined machines and use passive authentication (e.g., via AD agent) for those, while allowing BYOD to bypass user-based policies.
   • CUse only IP-based identification, mapping IP addresses to users.
   • DIntegrate with Cisco Identity Services Engine (ISE) for all devices.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A hospital uses Cisco WSA. They need to ensure that only authenticated users can access the internet, and they want to enforce different web policies for nurses and doctors. They also want to log the username for every request. Which user identification method should they use?

   • ATransparent user identification using the WSA's AD agent.
   • BUse IP-based authentication with static IP assignments.
   • CRely on the default policy without authentication.
   • DExplicit authentication using a proxy PAC file that prompts for AD credentials.
   Reveal Solution Discussion Select an answer first