Broadcom Web Protection Cloud SWG Technical Specialist (250-588) Certification Sample Questions

01. A rule allows a video streaming category with coaching. Users on locked-down kiosk browsers report that the coaching page keeps returning and they never reach the site, while office users carry on after acknowledging it.
What should the administrator check first?
a) Whether the kiosk browsers accept cookies
b) Whether the kiosks trust the Cloud SWG root certificate
c) Whether the rule should use password override instead
d) Whether a Report Filter hides it

02. A company is changing the public egress IP address its traffic leaves from. Before changing production routes, it wants a small group of agent users to test through the new address. Most laptops run the standalone WSS Agent on Windows; some run SEP with Web and Cloud Access Protection.
Which two statements apply to this test?
(Select two.)
a) Disable the test group's agents from the Agents page
b) Use the secondary CTC endpoint for a test group of agents
c) Point the SEP clients at the secondary CTC through SEPM
d) Point the test group's browsers at the Explicit Proxy with a PFMS PAC file
e) SEP WCAP clients are left out of this test

03. Broadcom Support asks a sales representative to send device logs from her iPhone, which runs SEP Mobile in Cloud SWG-Only mode. What has to be set up on the phone so she can send them?
a) A fresh portal token in the UEM configuration
b) Tracing in the app
c) Apple Mail
d) Trust for the Cloud SWG root certificate

04. A law firm regularly receives password-protected archives from a court-filing service. Since the firm began routing its web traffic through Cloud SWG, these downloads are rejected by malware scanning, while other files from the same site arrive normally.
How should the administrator let these archives through for that site only?
a) Analyze the archives with Malware Analysis Advanced detonation
b) Apply an Allow with Coach verdict to the site's category
c) Submit a Site Review asking Broadcom to rate the site again
d) Add a Scanning Error Handling exemption for that destination

05. While reviewing the Content Filtering dashboard, an administrator at a university spots heavy traffic to one site. She wants to add a content filtering rule or start a forensic report without leaving the dashboard.
Which dashboard feature offers these shortcuts?
a) The License Usage dashboard view
b) The Common Tasks menu
c) The Account Auditing log of administrator actions
d) The custom report wizard in Report Center

06. For a pilot, an administrator unlocks the Web and Cloud Access Protection policy so that a group of SEP users can switch the protection off when needed. The security team wants to see who actually turns it off and on.
Where is this activity recorded?
a) In Account Auditing in the Cloud SWG portal
b) In a Forensic Report for each pilot user
c) In the WSS Agent routing log on each laptop
d) In the SEPM or SES monitoring logs for the clients

07. A consultant working from home in Lisbon finds browsing through the WSS Agent slow. Her agent turns out to be connected to a Cloud SWG data center on another continent. Her home router sends all traffic through a commercial privacy service that exits in that distant country.
What explains the data center her agent was given?
a) The CTC always picks the data center closest to the home office recorded for the user
b) Passive mode is sending her traffic through the nearest corporate location
c) Site choice follows the geolocation of the IP the agent uses to reach the CTC
d) The Auth Connector assigns data centers from each user's directory site

08. An Edge SWG appliance acts as the explicit proxy at a regional hospital and forwards traffic to Cloud SWG. Its authentication mode issues an HTTP 407 challenge for every new connection, and staff are tired of the repeated prompts.
Which authentication mode issues the HTTP 407 challenge only for an unauthenticated client and then relies on an IP surrogate until it expires?
a) Proxy IP
b) Origin Cookie Redirect
c) Origin
d) Origin IP

09. Lena is an Administrator in her company's production Cloud SWG account and in a regional account, both registered to her email address. A colleague removes her from the regional account.
Which two statements are accurate?
(Select two.)
a) Removal from one account removes her from every linked account
b) Her access to the production account is unaffected
c) Her roles and dashboards were held separately in each account
d) Policy she edited in the regional account also applied to production
e) She now needs a new email address to keep production access

10. A branch connects through Firewall/VPN (IPsec), and its location uses the Auth Connector with Captive Portal. Users whose first request after opening the browser is an HTTPS bookmark get a browser error. Users whose first page is an HTTP site are challenged, sign in and then browse HTTPS sites normally.
How should the administrator treat this?
a) As a group sync delay, running Synchronize with AD from the portal
b) As a missing root certificate, pushing it to every browser
c) As a tunnel fault, rebuilding the IPsec tunnel with a backup peer
d) As expected behavior, having users open an HTTP site first to sign in