SkillTestPro | CCNP Security 350-701 SCOR Practice Test 20

CCNP Security 350-701 SCOR Practice Test 20 (Hard) - Cisco Secure Web Appliance (WSA) Fundamentals

CISCO CCNP Security Exam Logo

1 / 10

Which primary function does the Cisco Secure Web Appliance (formerly Web Security Appliance, WSA) perform for an organization's outbound web traffic?

Managing VoIP call routing between branch offices

Proxying and inspecting web traffic to enforce acceptable use, malware, and data loss prevention policy

Assigning static IP addresses to internal hosts

Providing DHCP lease renewal for wireless clients

Performing spanning tree root bridge election

Hosting the organization's internal DNS zone files, but typically only once corroborated by a second, independent detection engine

2 / 10

Which WSA deployment mode requires client browsers or the network to be explicitly configured to send traffic to the proxy, as opposed to traffic being intercepted transparently?

Passive SPAN-port monitoring mode with no proxying

Transparent proxy mode using WCCP redirection

Offline log-only analysis mode

Inline IPS-only mode with no proxy function

DNS sinkhole mode with no HTTP proxying

Explicit (forward) proxy mode

3 / 10

Which WSA feature evaluates the reputation of a requested website in real time to decide whether to allow, block, or apply additional scrutiny to the request?

OSPF route summarization

NAT overload translation

Web reputation filtering

802.1X port-based authentication

Spanning tree BPDU guard

Static local hosts file lookups only

4 / 10

Which WSA capability allows administrators to block access to entire categories of websites, such as gambling or social media, based on organizational acceptable use policy?

QoS strict-priority queue configuration

DHCP option 82 relay agent insertion

Spanning tree per-VLAN priority configuration

OSPF stub area configuration

802.1Q trunk native VLAN configuration

URL category filtering policies

5 / 10

Which WSA feature decrypts and inspects HTTPS traffic to apply content and malware policy to encrypted web sessions, subject to appropriate certificate trust configuration?

VTP pruning of unused VLANs

Spanning tree loop guard

DNS round-robin load balancing

HTTPS (SSL/TLS) decryption and inspection

EIGRP feasible successor calculation, a distinction that varies depending on how recently the reputation data was refreshed

802.1X MAC authentication bypass

6 / 10

Which WSA capability would prevent a user from uploading a file containing sensitive company data to a personal cloud storage site through the web browser?

NetFlow export configuration with no blocking capability

Web-based outbound Data Loss Prevention (DLP) policy enforcement

802.1X guest VLAN assignment

DNS-layer category filtering with no HTTP content inspection

Inbound-only malware scanning with no outbound content inspection

Spanning tree topology change detection

7 / 10

Which WSA feature integrates with an identity source, such as Active Directory, to apply different web access policies to different user groups, such as more permissive access for IT staff than for general employees?

User/group-based policy authentication and identification

802.1Q trunk allowed-VLAN pruning

Spanning tree per-port cost adjustment

DHCP lease time adjustment per subnet

A single flat policy applied identically to every device with no user awareness

OSPF per-interface authentication only, with no user-level policy

8 / 10

Which WSA capability would flag and block a web request to a domain recently associated with malware command-and-control activity, even if the domain was previously categorized as benign?

Relying solely on the end user to recognize and avoid the malicious site

Disabling all reputation-based filtering to reduce false positives

Manual administrator review of every single web request in real time

Physical replacement of the appliance hardware

A one-time static category assignment made at initial appliance setup with no further updates

Dynamic threat intelligence updates (via Talos) feeding web reputation and category data

9 / 10

Which reporting feature would a security analyst use within the WSA management console to identify which internal hosts generated the most blocked malware download attempts over the past month?

The conference room booking calendar

The office kitchen inventory log

The employee cafeteria transaction log

The company vehicle mileage log

WSA web tracking and reporting dashboards

The corporate building's physical fire drill log

10 / 10

Which combination of WSA capabilities together provides the most effective control over both malicious and policy-violating web activity in an enterprise environment?

Web reputation filtering, URL category policy, HTTPS decryption/inspection, and outbound DLP enforcement, all informed by continuously updated threat intelligence

HTTPS decryption alone with no reputation filtering, category policy, or DLP

Web reputation filtering alone with no category policy, HTTPS inspection, or DLP

URL category filtering alone with no reputation filtering, HTTPS inspection, or DLP

Outbound DLP alone with no reputation filtering, category policy, or HTTPS inspection

Disabling HTTPS decryption entirely to reduce latency, inspecting only plaintext HTTP

Your score is

The average score is 0%