Broadcom Edge SWG Diagnostics & Troubleshooting Technical Specialist (250-618) Certification Sample Questions

01. A help desk ticket reports that a business site is being blocked by an Edge SWG appliance, but the administrator cannot tell which of many configured rules is responsible.
What is the primary purpose of running a policy trace for that transaction?
a) It rewrites conflicting rules into a single consolidated evaluation order
b) It disables policy enforcement so the request can be retested
c) It records which rules were evaluated and which one matched the request
d) It reports how long each rule took to evaluate so slow rules can be tuned

02. Every user behind an Edge SWG appliance can reach the internet normally, but one particular external web application consistently fails to load for all of them.
Which cause is most consistent with this pattern?
a) A condition specific to that destination or how it is handled
b) The appliance has stopped forwarding requests to origin servers
c) The client endpoints have lost their proxy configuration
d) The deployment is operating in transparent rather than explicit mode

03. An administrator submits a policy change and the appliance reports that installation did not complete. The previously running policy continues to be enforced.
Which class of error most likely prevented activation?
a) A destination category that returned no classification result
b) A rule that matched no traffic during the preceding evaluation window
c) A rule ordered so that an earlier rule always shadows it
d) A policy definition error detected when the policy was compiled

04. An administrator is reviewing symptom reports to classify HTTPS failures in an intercepting Edge SWG deployment.
Which reported symptoms point toward a client-side rejection rather than an upstream one?
Select the two correct answers.
a) The proxy reports that it could not agree on negotiation parameters with the destination
b) The browser presents a certificate warning identifying an issuer it does not recognize
c) The destination name fails to resolve when queried from the proxy itself
d) The proxy reports that the destination requested a certificate it could not supply
e) A pinned application closes the connection without displaying any user-facing prompt

05. Two users on the same subnet complain about proxy authentication. User A is prompted for credentials and, after entering them correctly, is prompted again within minutes. User B is prompted once, enters correct credentials, and receives an access-denied page for the site requested.
Which conclusion is best supported by comparing the two cases?
a) User A has a credential-persistence problem, while User B is stopped by policy.
b) Both users are affected by the same underlying directory service outage.
c) Both users are failing authentication and should be treated as one incident.
d) User A is being handled as a guest, while User B is failing a group membership lookup.

06. A user reports that a page load hangs for a long period and then fails. The engineer wants to confirm whether the delay occurs before or after the request leaves the Edge SWG.
How should the capture be correlated with the reported symptom?
a) By counting the total number of packets recorded during the capture window
b) By confirming the capture file size matches the expected transfer volume
c) By comparing the capture against the appliance configuration in force at the time
d) By anchoring the capture to the reported time and reading the packet timing

07. Which certificate validation failure class is distinguished purely by the current date rather than by any property of the signing hierarchy?
a) Certificate with an untrusted issuer
b) Certificate past its validity dates
c) Certificate with an incomplete chain
d) Certificate with a name mismatch

08. A support engineer is reviewing an existing design in which authentication is enabled but the appliance is instructed to establish identity without treating a failure to authenticate as a reason to deny service. Users whose credentials cannot be established still receive filtered access under a generic identity.
What design consideration does the choice of authentication mode primarily express?
a) Which log formats the appliance may write for identified and unidentified traffic
b) Which directory service the realm contacts when several realms have been defined
c) How the challenge style and the surrogate mechanism are combined for a request
d) Whether encrypted sessions are intercepted before or after the user is identified

09. Users report that a partner site began returning a denial page yesterday. Several administrators made policy edits during that period, and each has a different theory about which change caused it.
What is the best first isolation step?
a) Reproduce the request and trace it to identify the rule that matched
b) Roll back every policy change made during the reported maintenance window
c) Disable each recently edited rule in turn until the site loads
d) Ask the site owner to confirm no change was made on their side

10. An Edge SWG deployment is configured so that a client which cannot complete integrated single sign-on is still able to authenticate.
Which description best characterises this fallback behaviour?
a) The appliance stops challenging and forwards the request without any identity.
b) The appliance re-issues the same integrated challenge until the client accepts it.
c) The appliance transfers the challenge to the directory service, which contacts the client.
d) The appliance offers a less integrated credential exchange the client supports.