mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: A company uses Cisco Web Security Appliance (WSA)…
A company uses Cisco Web Security Appliance (WSA) with transparent proxy mode. Recently, they enabled NTLM authentication. Some users are intermittently prompted for credentials while browsing. What is the most likely cause of this behavior?
⚠ Common exam trap
Cisco often tests the distinction between authentication protocol selection (Kerberos vs. NTLM) and the underlying transport behavior (persistent vs. non-persistent connections), leading candidates to incorrectly blame the protocol type rather than connection handling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request.
In transparent proxy mode with NTLM authentication, the WSA must maintain persistent connections to avoid re-authentication on every HTTP request. If the WSA is not configured to handle NTLM persistent connections (e.g., by enabling connection reuse or adjusting keepalive settings), the browser will be prompted repeatedly for credentials because each new TCP connection triggers a new NTLM challenge-response cycle. This intermittent behavior occurs because some connections may be reused while others are not, depending on browser and proxy settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The WSA is configured to prompt for authentication only for specific categories.
Why it's wrong here
Intermittent prompts are not typical for category-based prompting.
- ✗
The user's browser has cached an incorrect credential.
Why it's wrong here
Cached credentials should not cause intermittent prompts; they would either work or fail.
- ✗
The WSA is set to use Kerberos instead of NTLM.
Why it's wrong here
Using Kerberos instead of NTLM would not cause intermittent credential prompts because Kerberos relies on ticket-based authentication from a domain controller, not repeated NTLM challenge-response handshakes; the prompt issue stems from NTLM’s per-request negotiation, which Kerberos avoids entirely. This option is tempting because Kerberos is often deployed as a more seamless single sign-on protocol, and in environments where the WSA is integrated with Active Directory and clients have valid Kerberos tickets, it would eliminate the very prompts described in the stem.
- ✓
The WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request.
Why this is correct
Without persistent connections, each HTTP request may trigger a new NTLM challenge, leading to prompts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.