300-725 Sample Questions & Answers
Advanced Malware Protection and broader anti-malware defenses take the biggest share, alongside data-loss-prevention setup, Web Security Appliance proxy and reporting, authentication paired with HTTPS decryption, and access or identification policy.
Launch the full 300-725 simulator →Showing 8 of 17 free samples.
- Question 1Intermediate
Cisco WSA Features · Proxy Services
An administrator is configuring WCCP to redirect traffic from a Cisco Catalyst switch to a Cisco Web Security Appliance (WSA). The deployment requires the WSA to return traffic to the switch using a different interface than the one used for ingress traffic to avoid routing loops. Which WCCP forwarding method must be configured on both devices to support this topology?
Show answer & explanation
Correct answer: C
GRE encapsulation allows the WSA to be located on a different subnet or interface than the clients/routers and supports returning traffic via specific interfaces. L2 redirection requires Layer 2 adjacency.
- Question 2Intermediate
Cisco WSA Features · Proxy Services
A security architect is designing a transparent proxy deployment for a branch office. The requirement is to preserve the original client IP address in the logs of the upstream web servers for auditing purposes. Which feature should be enabled on the Cisco WSA?
Show answer & explanation
Correct answer: B
In transparent mode, enabling IP Spoofing allows the WSA to use the client's IP address as the source IP when connecting to the destination server, preserving it for server-side logging.
- Question 3Advanced
Configuration · Authentication
While troubleshooting an authentication issue, an administrator observes that users are being repeatedly prompted for credentials when accessing the internet. The WSA is configured for NTLM authentication. Which of the following conditions is the most likely cause of this behavior?
Show answer & explanation
Correct answer: C
Kerberos and NTLM (depending on security settings) are sensitive to time synchronization. If the WSA clock skews significantly (usually > 5 mins) from the DC, authentication tokens are rejected, causing repeated prompts.
- Question 4Advanced
Cisco WSA Features · Proxy Services
A multinational corporation uses a PAC file to direct user traffic. They want to ensure that if the primary WSA (10.1.1.10) is unavailable, traffic automatically fails over to the secondary WSA (10.1.1.20), and if both fail, traffic goes DIRECT. Which JavaScript return statement correctly implements this logic?
Show answer & explanation
Correct answer: C
PAC files process return values in order. The browser tries the first proxy; if it fails/times out, it tries the second, and finally falls back to DIRECT.
- Question 5Beginner
Cisco WSA Features · Proxy Services
Refer to the diagram below. A network administrator needs to place the Cisco WSA in the network to inspect traffic. If the goal is to deploy the WSA in Explicit Proxy mode without WCCP, where is the most appropriate placement and configuration for the end-user workstations?
Show answer & explanation
Correct answer: D
Explicit mode requires client browsers to be manually configured (or via GPO/PAC) to send traffic to the WSA. The WSA is typically placed in a DMZ or services segment reachable by clients.
- Question 6IntermediateSelect 2
Web Security Policies · Identification Policies
Which TWO of the following are valid methods for the Cisco WSA to identify a user when 'Transparent User Identification' is enabled? (Select TWO)
Show answer & explanation
Correct answers: C, E
ISE shares user session data (IP-to-User mapping) with WSA via pxGrid for transparent identification.
CDA maps IP addresses to users by reading AD security logs.
- Question 7Advanced
Cisco WSA Features · Proxy Services
True or False: In a Cisco WSA deployment using WCCP, the 'Mask' assignment method distributes traffic based on a hash of the source or destination IP address, providing better load balancing granularity than the 'Hash' method.
Show answer & explanation
Correct answer: A
The Mask assignment method uses a bitwise mask on IP addresses/ports to distribute traffic buckets. It is generally preferred over the older Hash method for scalability and hardware acceleration support on Catalyst switches.
- Question 8Intermediate
Configuration · HTTPS Decryption Policy
A company requires that all PDF files downloaded from external websites be inspected for malware, but they do not want to decrypt banking websites. How should the Decryption Policy be configured to achieve this?
Show answer & explanation
Correct answer: A
Decryption policies are evaluated top-down. Placing a Passthrough rule for Financial Services first ensures banking traffic is not inspected. Subsequent rules can then Decrypt other traffic to allow the Malware engine to inspect the content (like PDFs).
Ready for the real thing?
The full 300-725 simulator has every exam-style question, timed mode, and instant scoring.