Cisco 300-725 Online Practice Questions and Exam Preparation

Cisco 300-725 Online Questions & Answers

• Question 41:

  Which certificate format does a Cisco WSA need when HTTPS proxy is configured?

  A. DER
  B. CER
  C. PEM
  D. CRL
  C. PEM

  ---

  Explanation/Reference:

  Reference: https://community.cisco.com/t5/security-documents/wsa-training-series-how-to-configure-the-https-proxy-on-the/ta-p/3148673

• Question 42:

  Which statement about configuring an identification profile for machine authentication is true?

  A. Cloud Web Security Connector mode with an active directory enabled supports machine authentication
  B. Identification profile machine ID is supported locally, but the Cisco WSA does not support machine ID authentication
  C. Cloud Web Security with Kerberos enabled supports machine authentication
  D. If an Active Directory realm is used, identification can be performed for an authenticated user or IP address but not for a machine ID
  A. Cloud Web Security Connector mode with an active directory enabled supports machine authentication

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_01001.html

• Question 43:

  Which two configuration options are available on a Cisco WSA within a decryption policy? (Choose two.)

  A. Pass Through
  B. Warn
  C. Decrypt
  D. Allow
  E. Block
  A. Pass Through
  C. Decrypt

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-7/user_guide/b_WSA_UserGuide_11_7/b_WSA_UserGuide_11_7_chapter_01011.html

• Question 44:

  Which two benefits does AMP provide compared to the other scanning engines on the Cisco WSA? (Choose two.)

  A. protection against malware
  B. protection against zero-day attacks
  C. protection against spam
  D. protection against viruses
  E. protection against targeted file-based attacks
  A. protection against malware
  B. protection against zero-day attacks

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/advanced-malware-protection/solution-overview-c22-734228.html

• Question 45:

  Which two features can be used with an upstream and downstream Cisco WSA web proxy to have the upstream WSA identify users by their client IP address? (Choose two.)

  A. X-Forwarded-For
  B. high availability
  C. web cache
  D. via
  E. IP spoofing
  A. X-Forwarded-For
  D. via

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_0100.html

• Question 46:

  What is a benefit of integrating Cisco WSA with TrustSec in ISE?

  A. The policy trace tool can be used to match access policies using specific SGT
  B. Traffic of authenticated users who use 802.1x can be tagged with SGT to identification profiles in a Cisco WSA
  C. ISE can block authentication for users who generate multiple sessions using suspect TCP ports
  D. Users in a specific SGT can be denied access to certain social websites.
  D. Users in a specific SGT can be denied access to certain social websites.

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-WSAIntegrationDoc/b_ISE-WSAIntegration.html

• Question 47:

  Which two configuration options can be configured when invalid certificates are processed with the HTTPS proxy on WSA enabled? (Choose two.)

  A. allow
  B. monitor
  C. drop
  D. block
  E. redirect
  B. monitor
  C. drop

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-7/user_guide/b_WSA_UserGuide_11_7/b_WSA_UserGuide_11_7_chapter_01011.html

• Question 48:

  How does the Cisco WSA choose which scanning engine verdict to use when there is more than one verdict?

  A. based on the least restrictive verdict
  B. based on the most restrictive verdict
  C. based on the first verdict returned
  D. based on the last verdict returned
  B. based on the most restrictive verdict

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_010000.html

• Question 49:

  What is a benefit of integrating Cisco Cognitive Threat Analytics with a Cisco WSA?

  A. It adds additional information to the Cisco WSA reports
  B. It adds additional malware protection to the Cisco WSA
  C. It provides the ability to use artificial intelligence to block viruses
  D. It reduces time to identify threats in the network
  D. It reduces time to identify threats in the network

  ---

  Explanation/Reference:

  Reference: https://www.ironportstore.com/datasheets/data_sheet_c78-729630.pdf

• Question 50:

  Which statement about identification profile default settings on the Cisco WSA is true?

  A. Identification profiles do not require authentication
  B. Guest identification profile should be processed first
  C. Identification profiles can include only one user group
  D. AsyncOS processes identification profiles alphabetically
  A. Identification profiles do not require authentication

  ---

  Explanation/Reference:

  Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_011001.html#con_1415970