When a Cisco Web Security Appliance (WSA) experiences issues processing user requests, two primary caches are often the source of the problem. The authentication cache stores user credential and group membership information. If this data becomes stale or corrupt, users may face access denials or repeated credential prompts. Clearing it forces re-authentication. The DNS cache stores domain name-to-IP address resolutions. If a DNS entry is outdated or incorrect, the WSA cannot connect to the intended web server, causing requests to fail. Clearing this cache forces the WSA to perform a fresh DNS lookup, resolving connectivity issues.

B. application cache: "Application cache" is not a standard, user-clearable cache on the WSA for troubleshooting general request processing.

C. logging cache: The logging cache buffers log data before it is written. Clearing it affects reporting, not the real-time success or failure of user web requests.

E. HTTP cache: The HTTP cache stores web objects to improve performance. Clearing it resolves issues with stale content but not fundamental processing failures like authentication or name resolution.

1. Cisco AsyncOS 14.0 for Web Security Appliances CLI Reference Guide

Page 2-26

authcache command. The guide states the command "Clears the authentication cache

" which is used to resolve issues where users are not being authenticated correctly or are mapped to incorrect policies due to stale session information.

2. Cisco AsyncOS 14.0 for Web Security Appliances CLI Reference Guide

Page 2-71

dns-cache command. The documentation describes this command as being used to "Clears the DNS cache." This is a standard troubleshooting step when the WSA fails to resolve or resolves to an incorrect IP address for a website.

3. Cisco Web Security Appliance Best Practices Guide

Troubleshooting Section. This guide frequently recommends clearing the DNS and authentication caches as initial steps for resolving access and authentication problems

respectively. For example

under "Troubleshooting Website Access Issues

" it notes

"A common cause for access failure is a stale entry in the DNS cache." Similarly

for authentication issues

it advises clearing the authentication cache.

The solution correctly categorizes the methods based on how client traffic is directed to the Cisco Web Security Appliance (WSA).

• Transparent Mode intercepts web traffic without requiring any configuration on the end-user's client machine. The network infrastructure redirects the traffic. WCCP (Web Cache Communication Protocol) and PBR (Policy-Based Routing) are network-level technologies used on routers or Layer 3 switches to transparently forward specific traffic (like HTTP/HTTPS) to the WSA.
• Explicit Mode requires the client application (e.g., a web browser) to be explicitly configured to use the WSA as a proxy. A PAC (Proxy Auto-Configuration) file is a script that tells a browser where to send web requests. WPAD (Web Proxy Auto-Discovery Protocol) is a method that allows browsers to automatically discover the location of a PAC file, thus falling under the explicit configuration umbrella.

Cisco, AsyncOS 14.5 for Cisco Secure Web Appliance User Guide.

Section: "Deployment > Network Deployment Options > How the Secure Web Appliance Fits in the Network". This section describes the two primary deployment modes. It states, "In an explicit forward deployment, you configure client browsers to send traffic directly to the Secure Web Appliance... In a transparent deployment, the Secure Web Appliance is placed in the network in a way that it intercepts traffic as the traffic is routed through the network."

Cisco, Cisco Web Security Appliance Best Practices Guide.

Section: "Deployment > Transparent or Explicit Deployment". This guide details the methods for each mode. For transparent deployments, it specifies, "Transparently redirecting traffic to the web security appliance with a router that is configured for Web Cache Communication Protocol (WCCP) or with policy-based routing (PBR)..." For explicit deployments, it states, "In explicit deployment, user agents (typically web browsers) are configured to send their requests directly to the WSA... The primary methods of configuring the user agent are: Manual configuration, Proxy auto-config (PAC) files, Web Proxy Autodiscovery Protocol (WPAD)."

Cisco's Application Visibility and Control (AVC) provides granular control over applications by breaking them down into micro-applications or specific attributes. To restrict file uploads to Facebook, an administrator must target the specific functions responsible for this traffic.

File uploads on Facebook primarily occur when a user posts photos/videos or sends attachments via messages/chat. The "Facebook Photos and Videos" attribute specifically controls the uploading and viewing of media files. The "Facebook Messages and Chat" attribute governs the messaging function, which includes sending file attachments. By applying a "Block" or "Restrict" action to these two specific micro-applications within an access policy, an administrator can effectively prevent file uploads while allowing other general Facebook activities.

A. Monitor Facebook General: This attribute typically covers general browsing activities like viewing the news feed and profiles, not the specific action of uploading files.

B. Monitor Social Networking: This is a broad application category that includes many different platforms (e.g., Twitter, LinkedIn), not a specific, controllable action within Facebook.

E. Monitor Facebook Application: This refers to the entire Facebook application. Blocking this would deny all access to Facebook, which is not the goal of selectively restricting only file uploads.

1. Cisco Firepower Management Center Configuration Guide

Version 6.4: In the chapter "Application and URL Filtering in Access Control Policies

" the documentation explains the use of application filters for granular control. It states

"Many applications have sub-applications

called application tags

that you can use for more granular control. For example

the Facebook application has tags for chat

mail

video

and so on." This supports the principle of targeting specific sub-applications like "Photos and Videos" and "Messages and Chat" to control specific functions. (Reference Section: "Application Filters")

2. Cisco Application Visibility and Control (AVC) Solution Data Sheet: This document outlines the capabilities of AVC

emphasizing its ability to identify and control specific application behaviors. It notes that AVC can "identify thousands of applications and specific behaviors within applications

such as file transfer...within social media applications." This directly supports targeting the file transfer components of Facebook

which are "Photos and Videos" and attachments within "Messages and Chat". (Reference Section: "Key Features and Benefits")

3. NBAR2 Protocol Pack Library Documentation (for various releases): The official Network-Based Application Recognition (NBAR2) library

which powers AVC

lists the specific attributes for applications. For Facebook

it includes distinct attributes such as facebook-photos

facebook-video

and facebook-chat. These technical names directly correspond to the user-friendly options "Facebook Photos and Videos" and "Facebook Messages and Chat

" confirming they are the correct targets for controlling these specific actions. (Reference: Searchable NBAR2 Protocol Pack Library on Cisco.com for "Facebook" application attributes).

When configuring an exception for referred content within a Cisco Web Security Appliance (WSA) custom URL category, the administrator is presented with three distinct options to control how embedded content from a referring site is handled. These options are:

1. All Embedded/Referred: Allows all content from the specified referring site, regardless of its category.

2. Selected Embedded/Referred: Allows only the content from the referring site that matches specific, administrator-defined URL categories.

3. All Embedded/Referred Except: Allows all content from the referring site except for content that matches specific, administrator-defined URL categories.

These three choices provide comprehensive and granular control for creating policy exceptions.

A. This option is incorrect because it is incomplete. It omits the "selected embedded/referred" option, which is a valid and distinct choice for configuring exceptions.

B. This option is incorrect because it includes a non-existent option, "selected embedded/referred except." The correct options are "all," "selected," and "all except."

C. This option is incorrect because it is incomplete. It omits the "all embedded/referred" option, which is a fundamental choice for allowing all content from a referrer.

1. Cisco Web Security Appliance AsyncOS 14.0 User Guide:

Reference: Chapter: "Web Security Manager

" Section: "Access Policies

" Subsection: "Creating Custom URL Categories

" Topic: "Adding Sites with Referred Content to a Custom URL Category."

Details: The guide states

"When you add a site to this list

you can choose to allow all embedded content from this site

or you can choose to allow all embedded content except for content in selected categories

or you can choose to allow only content in selected categories." This directly corresponds to the three options listed in the correct answer.

2. Cisco Web Security Appliance Configuration Guide

Release 11.7:

Reference: Chapter: "Configuring Web Proxy Settings

" Section: "Controlling Access to Websites

" Subsection: "Creating Custom URL Categories to Control Access to Websites."

Details: In the procedure for adding sites with referred content

the guide details the three configuration choices available in the user interface: "All Embedded URLs

" "Selected Embedded URLs

" and "All Embedded URLs Except." This confirms the three distinct methods for creating exceptions.

In a cascaded proxy architecture, the upstream Cisco WSA sees requests originating from the downstream WSA's IP address, not the original client's. To preserve the client's IP identity for logging and policy enforcement on the upstream device, two primary methods can be used.

1. X-Forwarded-For (XFF) Header: The downstream WSA can be configured to insert the XFF HTTP header into requests it forwards. This header contains the original client's IP address, which the upstream WSA can then be configured to parse and use for identification.

2. IP Spoofing: The downstream WSA can be configured to "spoof" the client's IP address. In this mode, the downstream WSA forwards the request to the upstream WSA using the original client's IP address as the source IP in the packet headers.

B. high availability: This feature provides service redundancy and failover through clustering or other mechanisms; it does not relate to identifying client IP addresses in a proxy chain.

C. web cache: This feature improves performance by storing and serving frequently requested content locally. It is not involved in passing client identity information between proxies.

D. via: The Via HTTP header is used to track the path of a request through one or more proxies and for loop detection, not for explicitly identifying the original client's IP address.

1. Cisco AsyncOS 14.5 for Cisco Secure Web Appliance User Guide

"Connecting to Upstream Proxies

" Page 10-10. The guide states

"The Secure Web Appliance can add an X-Forwarded-For header to HTTP requests to identify the original client IP address to the upstream proxy."

2. Cisco AsyncOS 14.5 for Cisco Secure Web Appliance User Guide

"How the Web Proxy Handles Client Connections

" Page 10-11. The guide explains IP spoofing: "When you enable IP spoofing

the Secure Web Appliance spoofs the IP address of the client that initiated the request. The upstream proxy or firewall receives the request with the client’s IP address as the source address."

3. Cisco Content Security Management Appliance Configuration Guide

Release 11.0

"Editing and Duplicating a Web Proxy Profile

" Page 10-11. This document also describes the configuration for adding the X-Forwarded-For header for upstream proxies.