Broadcom Edge SWG Diagnostics & Troubleshooting Technical Specialist (250-618) Certification Sample Questions

01. A healthcare provider's Edge SWG already bypasses SSL interception for its few high-volume trusted sites. The CPU Monitor still shows SSL/Cryptography as the leading functional group, and memory pressure rises at peak. The remaining intercepted traffic is spread across thousands of different destinations, all of which must stay inspected.
Which next step fits this situation?
a) Extend the bypass list to cover the thousands of remaining destinations
b) Consolidate group lookups and simplify regex in the policy layers
c) Raise the memory figure at which TCP acceptance regulation engages
d) Tune the certificate cache and key size settings used for interception

02. An administrator at a regional hospital network signs in to the Edge SWG Admin Console and sees that the banner is indicating an issue with appliance health. The administrator suspects a licensing or subscription problem.
Where should the administrator go to see more information about the metric that raised the issue?
a) The Health Monitoring page
b) The Event Logging log tail
c) The policy coverage statistics
d) The Active Sessions report

03. An hour ago, a file with no file reputation classification was sent through the Content Analysis antivirus engines. Another user now requests the same file. Content Analysis logs show a verdict for the second request almost immediately, yet the antivirus engines record no new scan of the file.
Which explanation fits how Content Analysis processes the file?
a) Predictive analysis replaces the antivirus engines for any file requested more than once
b) A cached verdict was reused; caches precede the scanning stages
c) The file reputation service rescanned the file's contents with its own engine
d) The ICAP connection failed open, so the file was passed without any verdict

04. A new team member is learning how an Edge SWG appliance collects sysinfo automatically, so that data from the right period can be requested during an investigation.
Which two statements describe the default snapshot jobs?
(Select two.)
a) sysinfo takes a full snapshot every 60 minutes
b) sysinfo-stats records statistics every 24 hours
c) sysinfo takes a full snapshot every 24 hours
d) sysinfo-stats records packet captures every 60 minutes
e) sysinfo-stats records statistics every 60 minutes

05. A branch office's Edge SWG denies a gambling category by policy. Users report that the first visit to a newly registered gambling site loads normally, but later visits to the same site are denied. A policy trace of that first request shows the URL's category as pending.
Which WebPulse setting best explains this behavior?
a) WebPulse is in Background mode, so the first request proceeds while the URL is still being rated
b) WebPulse is in Real-time mode, which rates a new URL after the first response is delivered
c) WebPulse is disabled, so only the on-box database categorizes the URL on later visits
d) WebPulse is Suspended, so newly registered URLs are not rated on arrival

06. An administrator is investigating why one user's IWA authentication fails while colleagues on the same floor authenticate normally. The administrator wants to follow that user's authentication transactions step by step to see where in the exchange the failure occurs.
Which artifact provides this per-step authentication detail?
a) Access log entries for the user's requests
b) LSA debug output
c) LSA stats for the authentication subsystem
d) The appliance's event log

07. An operations lead is drawing an architecture diagram that shows Edge SWG appliances, Content Analysis and Reporter, and needs to place Symantec Management Center correctly.
Which role does Management Center play?
a) An on-box console that manages just the single appliance on which it is installed
b) A log database that stores access records but has no device management function
c) Centralized management and visibility for Edge SWG and related components
d) A scanning service that receives files from Edge SWG appliances over ICAP for analysis

08. A rule allows members of the Payroll group to reach a payroll provider's site. A Payroll user reports being blocked. The access log shows the request with the user's correct username, so authentication succeeded. The administrator needs to confirm whether the user's Payroll membership was applied when policy evaluated that request.
Which tool should the administrator use?
a) A policy trace of the user's request
b) LSA stats for the authentication subsystem
c) A packet capture between the client and the appliance
d) The event log filtered to realm events

09. An Edge SWG appliance authenticates users through an IWA realm. Users are challenged and authenticate successfully, a policy trace of a sample request shows the authenticated user and group, and the realm reports as healthy. Yet the access log records the collector receives carry no username for any user.
What is the most likely cause?
a) The IWA realm is intermittently unavailable, so identity is never established
b) The authentication policy does not apply to the traffic that is logged
c) The upload client strips identity data from each record before delivery
d) The log format omits user fields such as x-bluecoat-username and user

10. A network team asks whether an internal application's host record can be created on the Edge SWG so that users behind the proxy resolve the application by name. Before answering, the specialist needs to state the appliance's role in name resolution.
Which statement describes that role?
a) It serves as the authoritative source for the zones its clients query most often
b) It forwards recursive queries and answers from its cache
c) It holds authoritative copies of any zone its name servers have answered for
d) It answers authoritatively once a record has stayed in its cache for a full lifetime