Broadcom Edge SWG Administration Technical Specialist (250-621) Certification Sample Questions

01. An administrator adds a Web Access rule that denies a category supplied by a second content filtering provider the company recently purchased. The rule installs without errors, but a policy trace shows the category never matches any request, while categories from the existing provider match normally.
What is the most likely cause?
a) WebPulse is in Background mode, so the category stays pending
b) The rule belongs in the SSL Access layer rather than in Web Access
c) The new provider is not enabled with a valid license
d) Rules that reference a second provider must be written in the Central file

02. For a profile used on high-risk sites, the security team wants the endpoint to receive none of the page's DOM elements or CSS, not just to have internal logic and API calls hidden.
Which rendering mode satisfies this, and at what cost?
a) Vector Rendering Mode, which hides DOM elements and CSS and consumes fewer network resources
b) Grid Rendering Mode, which shows the page as text and consumes fewer network resources
c) Vector Rendering Mode, which is the default and passes the original page code through
d) Grid Rendering Mode, which shows the page as images and consumes higher network resources

03. Users on isolated untrusted sites must be able to read PDF documents but never save them to their computers. Executables from those sites are treated as dangerous and must not reach the isolation server at all. Compressed archives are treated as neutral and may be delivered only after a threat check.
Which download profile assignment meets these requirements?
a) PDF documents: View; executables: Block; archives: Scan
b) PDF documents: Scan; executables: Block; archives: Allow
c) PDF documents: View; executables: Scan; archives: Allow
d) PDF documents: Allow; executables: Block; archives: View

04. A company's acceptable use policy must block the Gambling category for all staff. Users also complain that first visits to brand-new sites stall while the appliance waits for a rating. Management accepts letting those first requests through, provided new sites are still rated by WebPulse.
Which configuration choices meet both requirements?
(Select two.)
a) WebPulse dynamic categorization set to Disable mode
b) A Web Access rule that denies a Request URL Category object for Gambling
c) A current WebFilter database download, which blocks Gambling once installed
d) A Notify User coaching action for the Gambling category
e) WebPulse dynamic categorization set to Background mode

05. An intermittent policy problem affects several branch Edge SWG appliances only at around 02:00. The administrator wants Management Center to capture a policy trace on those appliances at that time, without anyone logging in to them overnight.
What should the administrator create?
a) A job triggered by the Device added to Group event
b) A Retrieve Policy Coverage job, scheduled for 02:00
c) A Statistics Monitoring report covering the hours around 02:00
d) A job with the policy trace operation, scheduled for 02:00

06. Security is the priority on an Edge SWG whose default proxy policy is Deny. A newly launched internal wiki is denied for every user. A policy trace of one request shows that no rule in any Web Access layer matched it, and the final action is Deny.
What should the administrator change so the wiki is reachable without weakening policy for other traffic?
a) Add a rule that allows the internal wiki in a Web Access layer
b) Change the default proxy policy on the appliance to Allow
c) Enable tracing in the rule that is denying the wiki, then repeat the request
d) Reorder the layers so the last Web Access layer is evaluated first

07. An early Web Access layer denies destinations in the High threat risk band for everyone. A later Web Access layer, added for an executive group, allows all requests from that group so that no business site is blocked for them. Executives can now reach High-risk sites. The executive exception must stay in place.
Which change keeps the High-risk block in force for every user?
a) Move the executive allow rule into the deny layer, above the deny rule
b) Change the deny rule's action to Force Deny so later layers cannot override it
c) Set the default proxy policy to Deny
d) Move the deny layer so that it is evaluated before every other layer in the policy

08. A transparent Edge SWG serves single-user desktops and also Citrix servers on which dozens of users share one IP address. All browsers accept cookies. The administrator must choose one authentication mode that works for clients without proxy settings and never credits one user's authentication to another.
Which mode should be configured?
a) Origin IP Redirect, for its HTTP 401 challenge
b) Proxy IP, scoped to the Citrix servers' subnet
c) Origin Cookie Redirect
d) Proxy, with no surrogate credential at all

09. On a transparent Edge SWG deployment, the HTTP proxy service has only its Default listener, and that listener is set to Intercept. HTTP traffic from a test lab subnet must now pass through the appliance unprocessed, permanently, while HTTP from every other subnet stays intercepted.
Which change meets this requirement?
a) Set the HTTP service to Bypass and add a listener for the lab subnet set to Intercept
b) Set the Default listener to Bypass and add a Web Access rule denying the lab subnet
c) Keep the Default listener at Intercept and allow the lab subnet in a Web Access rule
d) Add a listener with the lab subnet as its source address and the Bypass action

10. An administrator is writing VPM policy so that files users download from the Software Downloads category are sent to Content Analysis for malware scanning. Access to the category is already allowed by an existing Web Access rule.
Which VPM layer type is designed for the rule that sends this content to Content Analysis?
a) Web Access layer
b) SSL Access layer
c) Web Content layer
d) Web Authentication layer