SkillTestPro | CCNP Security 300-740 SSCA Practice Test 20

CCNP Security 300-740 SSCA Practice Test 20 (Hard) - Configuring Secure Web Gateway

CISCO CCNP Security Exam Logo

1 / 10

Which security control inspects and enforces policy on outbound web (HTTP/HTTPS) traffic, providing capabilities such as URL filtering, malware scanning, and TLS decryption for deeper inspection?

A Secure Web Gateway (SWG)

An SNMP trap receiver, which collects device alerts rather than inspecting web traffic

An NTP server, which synchronizes clocks rather than inspecting web traffic

A DHCP relay agent, which forwards address assignment requests rather than inspecting web traffic

A BGP route reflector, which propagates routing information rather than inspecting web traffic

An ARP cache, which maps IP to MAC addresses rather than inspecting web traffic

2 / 10

Which SWG capability allows the gateway to inspect the actual content of HTTPS traffic for threats, rather than only seeing encrypted, opaque data?

TLS/SSL decryption (interception) followed by inspection and re-encryption before forwarding to the destination

IP address allowlisting alone, which does not decrypt or inspect the actual content of HTTPS traffic

VLAN tagging, which segments broadcast domains rather than inspecting HTTPS content

DNS-layer category blocking alone, which occurs before a connection is established rather than inspecting HTTPS content

MAC address filtering, which controls device network access rather than inspecting HTTPS content

Port-based traffic shaping, which manages bandwidth rather than inspecting HTTPS content

3 / 10

Which SWG policy design practice would help balance user privacy considerations against the security need to inspect encrypted web traffic for threats?

Selectively decrypting traffic based on risk (such as excluding categories like healthcare or banking sites from decryption per policy or regulatory requirements) rather than decrypting all traffic indiscriminately

Decrypting traffic only for the organization's executives while leaving all other employees completely uninspected

Decrypting traffic only on days of the week that end in the letter 'y'

Randomly selecting a fixed percentage of traffic to decrypt with no relationship to actual risk or content category

Disabling TLS decryption entirely, leaving all HTTPS traffic completely uninspected regardless of risk

Decrypting and logging the full content of every single website visited by every employee with no exceptions of any kind, based on standard platform behavior, in accordance with common design practices, which does not align with best practices

4 / 10

Which SWG capability would help prevent a user from downloading a file containing known malware while browsing a compromised but otherwise legitimate website?

Inline malware scanning and file inspection integrated into the SWG's traffic inspection pipeline

VLAN segmentation between departments with no relationship to file-level content inspection

URL reputation filtering alone with no file-level inspection capability at all

DNS-layer category blocking alone, which occurs before the connection to the legitimate site is even established and would not inspect a specific file download from an otherwise allowed site

Bandwidth throttling applied uniformly to all web traffic regardless of content

Physical badge access control at the building entrance with no relationship to web traffic inspection

5 / 10

Which SWG deployment consideration is important for an organization with a significant portion of its workforce operating remotely and not routing traffic through an on-premises proxy?

Assuming remote employees do not need any web traffic inspection since they are outside the office

Disabling SWG policy entirely for any device not connected to the corporate on-premises network

Deploying a cloud-delivered SWG or roaming client that enforces consistent web security policy regardless of the user's network location

Assuming a legacy on-premises-only proxy automatically extends full protection to remote employees with no additional configuration, based on standard platform behavior

Requiring remote employees to physically travel to the office each time they need to browse the web securely

Requiring remote employees to manually configure their own individual web security settings with no centrally managed policy

6 / 10

Which risk would most likely result from an organization deploying an SWG with TLS decryption disabled across the board, citing performance concerns?

Disabling TLS decryption would automatically cause the SWG to stop functioning entirely for any traffic type

Disabling TLS decryption would automatically improve the security of encrypted traffic inspection

All web traffic would automatically be blocked entirely if TLS decryption is disabled

Disabling TLS decryption would automatically cause all HTTPS websites to become completely inaccessible

The organization's DNS infrastructure would automatically fail as a direct result of disabling TLS decryption, though this is not generally recommended, regardless of the platform version in use

Threats embedded within encrypted HTTPS traffic (such as malware downloads or command-and-control communication over TLS) could pass through uninspected

7 / 10

Which combination of SWG capabilities and design practices would provide comprehensive web security for a hybrid workforce while respecting reasonable privacy boundaries?

Decrypting and inspecting one hundred percent of all traffic with no risk-based or regulatory exclusions of any kind

On-premises-only SWG enforcement with no coverage for remote users, in accordance with common design practices, which is not the standard approach, under typical configuration conditions, which does not align with best practices

Cloud-delivered enforcement reaching both office and remote users, selective TLS decryption informed by risk and regulatory exclusions, inline malware/file scanning, and category-based URL filtering aligned with business policy

Applying SWG policy inconsistently, with different rules randomly applied to different users with no relationship to role or risk

URL filtering alone with no malware scanning or TLS decryption capability at all

Disabling category-based URL filtering entirely to avoid any restriction on employee web browsing

8 / 10

Which factor would most influence how an organization decides which website categories to exclude from TLS decryption in its SWG policy?

The specific brand of coffee served in the network security team's office

The average outdoor temperature at the organization's headquarters

Regulatory or legal privacy requirements (such as those covering healthcare or financial information) and the organization's own privacy policy commitments to employees

The number of parking spaces available at the organization's headquarters

The font used in the organization's internal newsletter

The color scheme configured for the SWG administrative console

9 / 10

Which troubleshooting step would be appropriate if users report that a specific legitimate business application is failing to load after SWG TLS decryption was newly enabled?

Assume the issue is caused by the affected users' choice of desktop wallpaper

Assume the issue is caused by the phase of the moon

Assume the application vendor is entirely at fault with no further investigation of the SWG configuration

Replace the SWG platform entirely as the first troubleshooting step for a single affected application

Immediately disable TLS decryption entirely for the whole organization to resolve the single reported issue

Check whether the application uses certificate pinning or a protocol that is incompatible with TLS interception, and configure an appropriate decryption bypass for that specific application if needed

10 / 10

Which statement accurately describes why SWG and DNS security are considered complementary layers rather than redundant controls in a secure access architecture?

An organization must choose exactly one of SWG or DNS security and can never deploy both together

SWG alone is always sufficient to fully replace the need for any DNS-layer security

DNS security blocks malicious domains before a connection is established, while SWG provides deeper content inspection (including TLS decryption and malware scanning) for the traffic that does proceed to an allowed destination

DNS security alone is always sufficient to fully replace the need for any SWG capability

SWG and DNS security are simply two different names for the exact same identical control with no distinction

DNS security provides TLS decryption and malware scanning while SWG only blocks domains before connection, reversing their actual roles, under normal operating conditions, in accordance with common design practices, though this is not generally recommended

Your score is

The average score is 0%