The Cisco Web Security Appliance (WSA) uses the Referer field within the HTTP request header to implement referrer exceptions. This header field indicates the URL of the web page from which the requested resource was linked. By inspecting this header, the WSA can create policy exceptions, for example, to allow access to embedded content from a specific trusted website while blocking direct access to that same content. The feature relies entirely on parsing this specific header information.

A. protocol: The protocol (e.g., HTTP, HTTPS) defines the communication standard but does not contain the referring URL.

B. version: The HTTP version (e.g., HTTP/1.1) specifies the syntax and rules of the protocol, not the origin of the request.

D. payload: The payload, or body, of an HTTP request contains data being sent to the server (e.g., form data) and does not include the Referer information.

1. Cisco. (2017). Cisco Web Security Appliance Best Practices Guide. Document ID: 118916. In the section "Creating a Custom URL Category for Referrer Header Exceptions

" the guide states

"This custom URL category will contain a regular expression that will match on the HTTP Referer Header of the request."

2. Cisco. (2023). AsyncOS 15.0 for Cisco Web Security Appliances User Guide. In the chapter "Access Policies

" the section "Creating Custom URL Categories to Use in Policies" describes how to define URL categories by matching transaction elements

including the "Referer Header." This confirms that the header is the source of information for this feature.

On a factory-fresh Cisco Web Security Appliance (WSA) the dedicated Management (M1) interface is pre-configured with the static address 192.168.42.42/24.

The System Setup Wizard is launched through the HTTPS service that, by default, listens on TCP port 8080. Therefore a browser pointed to

https://192.168.42.42:8080 connects directly to the wizard without any prior CLI configuration.

A. Uses HTTP (not allowed) and port 80; the wizard only answers on HTTPS 8080.

C. Uses the wrong IP (192.168.42.10) and port 8443, not the factory defaults.

D. Incorrect network address (192.168.43.42) and uses HTTP; port 8080 must be HTTPS on the default IP.

1. Cisco Systems

“Cisco S-Series Web Security Appliance Quick Start Guide

” OL-23920-05

p. 8

Step 5: “Open a web browser and enter https://192.168.42.42:8080 to start the System Setup Wizard.”

2. Cisco

“AsyncOS 12.5 for Cisco Web Security Appliance User Guide

” Chapter 2 “Running the System Setup Wizard

” p. 2-3: “Access the wizard at https://192.168.42.42:8080 on the management port.”

3. Cisco Networking Academy

“Securing the Web with Cisco Web Security Appliance (SWSA) v1.0 Course Manual

” Module 3

Slide 11: “Default management address 192.168.42.42

HTTPS port 8080 for initial setup.”

An identification profile on the Cisco Web Security Appliance (WSA) is used to identify users and map them to policies. A key feature is the ability to identify users based on criteria other than credentials, such as IP address. Therefore, an administrator can explicitly configure an identification profile to use "No Authentication." This is a common configuration for creating policies for guest users or for traffic from specific subnets where user-level authentication is not required or feasible. This flexibility is a fundamental aspect of how identification profiles function.

B. The Guest identification profile, typically a catch-all for unauthenticated users, should be processed last to allow more specific, authenticated profiles to be matched first.

C. An identification profile can be associated with multiple user groups from a single authentication realm, allowing for granular policy application to various sets of users.

D. AsyncOS processes identification profiles in the order they are listed in the configuration table (top-down), which is manually configurable by the administrator, not alphabetically.

1. Cisco Web Security Appliance Configuration Guide

14.0: In the chapter "Identities and User Identification

" the section "How the Web Security Appliance Identifies Users" explains the processing order. It states

"AsyncOS for Web evaluates identification profiles in the order that they are listed in the table on the Identification Profiles page." This refutes options B and D.

2. Cisco Web Security Appliance Configuration Guide

14.0: In the same chapter

the section "Creating a Custom Identification Profile" details the configuration steps. Step 6 in the "Procedure" subsection shows the option to select an "Authentication Realm" or choose "No Authentication

" which directly supports option A.

3. Cisco Web Security Appliance Configuration Guide

14.0: The section "Creating a Custom Identification Profile" also shows that when an authentication realm is selected

an administrator can select one or more user groups to apply the profile to. This directly refutes option C. The guide states

"Select the user groups to which this profile applies." The interface allows for multiple selections.

The question requires matching web proxy configuration properties with their functional descriptions.

• In-Use Connection Timeout applies to a connection that is actively handling a transaction but has become idle. It prevents a session from hanging indefinitely if a client or server stops sending data mid-transaction.
• Persistent Connection Timeout (also known as a keep-alive timeout) applies after a transaction is finished. It keeps the TCP connection open for a short period to reuse it for subsequent requests from the same client, improving performance by avoiding the overhead of re-establishing connections.
• Simultaneous Persistent Connections is a resource management setting that limits the total number of open keep-alive connections (TCP sockets) the proxy can maintain with upstream servers to prevent resource exhaustion.
• Use Received Headers enables the proxy to process headers like X-Forwarded-For, which are added by downstream proxies. This allows an upstream server or another proxy to identify the original client's IP address, which is essential for logging, access control, and content localization.

Microsoft TechNet Archives for ISA Server 2004: This official documentation details the advanced web proxy settings that are conceptually identical to those in later products like Forefront TMG.

In-use connection timeout: "Specify the maximum time...that [the proxy] waits for more data from an idle client or server when the current transaction has not yet been completed."

Persistent connection timeout: "Specify the maximum time...that [the proxy] keeps a persistent connection to a client or server open after a transaction has been completed and no further activity is detected."

Maximum simultaneous persistent connections per server: "Specify the maximum number of TCP sockets that [the proxy] keeps open with servers."

Use received headers to identify original client: "Select this check box to allow an upstream proxy server to identify clients by IP address... the X-Forwarded-For request header field allows identification of the original client of a request that was passed through a proxy server." (Note: This content is available through various archived versions of the Microsoft TechNet Library online.)

Fielding, R., et al. (1999). Hypertext Transfer Protocol -- HTTP/1.1. RFC 2616. Internet Engineering Task Force (IETF).

Section 8.1.2.1, "Time-outs": This section of the foundational HTTP/1.1 standard discusses the necessity for servers, clients, and proxies to have time-out intervals. It distinguishes between timeouts for idle connections between requests (Persistent Connection Timeout) and timeouts while waiting for a response during a transaction (related to In-Use Connection Timeout). The concept of persistent connections is detailed in Section 8.1. (DOI: https://doi.org/10.17487/RFC2616)

A Cisco Web Security Appliance (WSA) Decryption Policy is designed to handle HTTPS traffic by making a decision on whether to intercept it for inspection. The two primary actions available within these policies are 'Decrypt' and 'Pass Through'. The 'Decrypt' action instructs the WSA to perform TLS/SSL interception, decrypt the traffic for inspection by other security engines, and then re-encrypt it. The 'Pass Through' action allows the encrypted traffic to bypass decryption and inspection, which is essential for sensitive categories like financial services or for applications that use certificate pinning and would otherwise fail.

B. Warn: This is an action available in Access Policies to present a warning page to the user, not a valid action within a Decryption Policy.

D. Allow: This is a general term and a specific action in Access Policies. In Decryption Policies, the actions for permitted traffic are more specific ('Decrypt' or 'Pass Through').

E. Block: While 'Drop' (the equivalent of Block) is a valid action in a Decryption Policy, 'Decrypt' and 'Pass Through' are the two fundamental, non-terminating actions that define the policy's primary purpose.

1. Source: Cisco Web Security Appliance AsyncOS 15.0 User Guide

Reference: Chapter 11

"Managing Decryption Policies

" Section: "Actions in Decryption Policy Rules

" Page 11-6.

Quote: "For each policy rule

you can configure one of the following actions to be taken on traffic that matches the rule criteria: Decrypt

Pass Through

Drop." (This confirms that 'Decrypt' and 'Pass Through' are primary actions. 'Drop' is the equivalent of 'Block').

2. Source: Cisco Web Security Appliance Configuration Guide - Configure HTTPS Inspection

Reference: Section "Configure Decryption Policies"

Details: The configuration steps and screenshots in this official guide consistently show the available actions for a decryption policy rule as "Decrypt

" "Pass Through

" and "Drop." This distinguishes them from Access Policy actions like "Allow

" "Warn

" or "Block" (though Drop has the same effect as Block).

To troubleshoot WCCP communication failures, the most effective CLI action is to examine the WCCP-specific logs. Enabling debug logging for the WCCP service provides verbose, real-time information about the protocol negotiation between the Cisco WSA (cache engine) and the Cisco ASA (router). These logs will show the critical "Here I Am" messages from the WSA and the corresponding "I See You" responses from the ASA. Analyzing these messages confirms whether a WCCP session is being established, maintained, or is failing, directly addressing the core of the problem.

A. Disable WCCP to see if the WCCP service is causing the issue: This is a fault isolation step, not a diagnostic one. It confirms if WCCP is the problem area but does not provide any details on why communication is failing.

B. Explicitly point the browser to the proxy: This action bypasses the WCCP redirection mechanism entirely. It tests the WSA's ability to function as an explicit proxy but does not troubleshoot the transparent WCCP communication.

C. Ping the WCCP device: Pinging only verifies basic Layer 3 (IP) connectivity. WCCP communication can still fail due to firewall rules, ACLs, or configuration issues on UDP port 2048, even if ICMP (ping) is successful.

1. Cisco

"AsyncOS 14.0 for Cisco Secure Web Appliance CLI Reference Guide

" Page 499.

The wccpdebug command is described as a tool to "Set the WCCP debug level." This command is used to increase the verbosity of WCCP logs for troubleshooting communication issues. The guide states its purpose is for debugging WCCP.

2. Cisco

"Troubleshoot Web Cache Communication Protocol (WCCP) on the Cisco Web Security Appliance

" Document ID: 118728

Updated: 29-Aug-2014.

Under the "Troubleshoot" section

the document advises

"Check the WCCP logs on the WSA... From the CLI

enter the grep command and choose the wccplogs." It further explains that these logs show the "Here I Am" and "I See You" packets

which are essential for verifying WCCP negotiation.

3. Cisco

"WSA FAQ: How do you troubleshoot WCCP?

" Document ID: 117835

Updated: 13-Feb-2020.

This document explicitly states

"The first place to check for WCCP issues is the wccp logs on the WSA... From the CLI

you can tail the wccplogs." This confirms that checking logs is the primary CLI-based troubleshooting step for WCCP communication.

Under Security Services ➜ HTTPS Proxy ➜ Certificate Validation, the only actions the Cisco Secure Web (WSA) appliance lets you set for a server certificate that fails validation are 1) Monitor-–pass the traffic but log the event, and 2) Drop-–reset the TCP connection and deny access. No other response (allow/pass-through, block page, redirect, etc.) is offered for this specific condition.

A. allow – Not an available action; “pass-through/allow” cannot be chosen for invalid-certificate handling.

D. block – “Block” is used in URL/category policies, not in the certificate-validation action list.

E. redirect – WSA does not support redirection for invalid certificate events.

1. Cisco Secure Web Appliance (WSA) AsyncOS 14.0 User Guide

“Configuring Certificate Validation for the HTTPS Proxy

” Table 18-3 – Action for Invalid Certificates: Monitor | Drop (cisco.com

Doc ID: WSA14.0UG

p. 652-653).

2. Cisco Secure Web Appliance 15.0 CLI Guide

command sslproxyconfig → certificate-validation-action {monitor | drop} (Section “HTTPS Proxy Certificate Controls

” p. 198).

The Cisco Web Security Appliance (WSA) processes access policy elements in a specific, logical order. First, it identifies the destination by checking URL categories, with user-defined custom URL categories taking precedence over the predefined URL category database. Once the URL is permitted, the WSA uses Application Visibility and Control (AVC) to identify the specific web application via the application filter. If the application is allowed, the WSA then inspects the content's file type using the MIME type filter. Finally, if the content is permitted by all preceding policies, it undergoes security scanning for threats, such as malware scanning, before being delivered to the end-user. This sequence ensures efficient and layered policy enforcement.

Cisco AsyncOS 15.0 for Web User Guide:

Section: "About Policies," sub-section "How Policies Are Applied to Client Requests." This section details the hierarchical structure of policy evaluation. It explains that URL categorization is one of the initial checks within an Access Policy. The documentation implicitly supports the precedence of custom categories as they are user-defined overrides.

Section: "Controlling Web Applications with Application Visibility and Control." This chapter describes how AVC (application filtering) is applied after initial URL filtering is complete.

Section: "Scanning for Viruses and Malware." This part of the documentation clarifies that anti-malware scanning is a content security service applied to traffic that has already been permitted by access and decryption policies.

Cisco Live Presentation BRKSEC-3303 - Advanced Web Security with Cisco WSA:

The presentation slides on "WSA Policy Engine" and "Order of Operations" explicitly show the flow of a web request through the WSA. The diagrams confirm that URL lookups (custom and predefined) occur first, followed by application controls (AVC), object filtering (MIME types), and then security services like Advanced Malware Protection (AMP) and anti-virus scanning. This source provides a visual and sequential confirmation of the answer.

Cisco Cognitive Threat Analytics (CTA), now part of Cisco Secure Cloud Analytics, is a cloud-based breach detection system. It ingests and analyzes web proxy logs from devices like the Cisco Web Security Appliance (WSA). By applying advanced statistical modeling and machine learning, CTA identifies anomalies and patterns indicative of malicious activity, such as command-and-control (C2) communication or data exfiltration, that have already bypassed traditional perimeter defenses. Its primary benefit is automating this complex analysis to significantly shorten the time-to-detection (TTD) for threats already active within the network, reducing the average discovery time from months to hours.

A. CTA generates its own distinct reports and alerts in its own dashboard; it does not directly add information into the native reports on the Cisco WSA itself.

B. CTA is a post-infection detection tool that analyzes logs. It does not provide additional real-time, inline malware blocking or protection capabilities to the WSA.

C. While CTA uses machine learning (a form of AI), its function is threat detection through log analysis, not the direct, inline blocking of viruses.

1. Cisco

"Cisco Cognitive Threat Analytics At-A-Glance". Document ID: C45-736554-02. Published 2018.

Page 1

Product Overview: "It addresses gaps in perimeter defense by identifying the symptoms of a malware infection or data breach. This reduces time to discovery of threats that are operating inside the network."

Page 1

How It Works: "Cognitive Threat Analytics is not an inline solution. It does not block traffic..."

2. Cisco

"Cisco Secure Cloud Analytics At-A-Glance". Document ID: C45-742430-02. Published 2021.

Page 1

Solution: "Cisco Secure Cloud Analytics... can reduce time to detection to as little as a few hours." This document for the successor product confirms the same primary benefit.

The Cisco Web Security Appliance (WSA) operates primarily in two distinct modes to intercept and inspect web traffic. In explicit forward mode, client browsers and applications are manually or automatically configured (e.g., via PAC files or GPO) to send web requests directly to the WSA. In transparent mode, network traffic is transparently redirected to the WSA by a network device like a router or firewall using technologies such as Web Cache Communication Protocol (WCCP) or Policy-Based Routing (PBR), without requiring any configuration on the end-user's client.

A. connector: This term typically refers to a software agent or client (like Cisco Secure Endpoint connector), not a primary operational mode for the WSA appliance itself.

B. proxy: While the WSA functions as a proxy, "proxy" is its role, not a specific mode of operation. Explicit and transparent are the specific modes describing how it functions as a proxy.

D. standard: "Standard" is not an officially recognized term for a Cisco WSA deployment or operational mode.

1. Cisco Web Security Appliance Configuration Guide

14.0

"Deploying the Web Security Appliance" chapter

"Deployment Methods" section: "You can deploy the Web Security appliance in either explicit forward mode or transparent mode." This section further details both modes.

2. Cisco Web Security Appliance Configuration Guide

12.0

"Deploying the Web Security Appliance" chapter

"How the Web Security Appliance Fits into the Network" section: "The Web Security appliance can be deployed in transparent mode or explicit forward mode." It proceeds to describe how traffic is handled in each scenario.

3. Cisco Live Presentation BRKSEC-3303

"Advanced Web Security Deployment with Cisco WSA

" Deployment Modes slide: This presentation clearly outlines the two primary deployment modes as "Explicit Forward Proxy" and "Transparent Proxy

" detailing the pros and cons of each.