hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A financial services company recently migrated…
A financial services company recently migrated from a legacy web filter to Cisco WSA in explicit proxy mode. The company has 5000 users across three offices, each connected via MPLS. The WSA is deployed in the data center. A week after deployment, users in the remote office report that web pages load extremely slowly, while users in the main office near the data center experience normal speeds. The network team confirms there is no WAN congestion. The WSA administrator checks the logs and sees that the remote users are being authenticated via NTLM and that the WSA's CPU and memory usage are below 50%. However, the number of concurrent connections from the remote office is very high, with many connections in a TIME_WAIT state. What is the most likely cause of the slow web performance for remote users?
⚠ Common exam trap
The trap here is that candidates often attribute slow performance to authentication delays (NTLM) or SSL decryption, but the key clue is the high number of TIME_WAIT connections, which points to TCP connection overhead rather than authentication or encryption processing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The WSA is not configured to reuse TCP connections, causing high connection overhead for remote users.
The high number of concurrent connections in TIME_WAIT state indicates that TCP connections are being closed after each request instead of being reused. In explicit proxy mode, the WSA can reuse persistent connections to reduce latency, but if connection reuse is not configured, each HTTP request from a remote user requires a new TCP handshake, which adds significant round-trip time (RTT) over the MPLS link. This overhead explains the slow performance for remote users while main office users, with lower latency, are unaffected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The WSA's proxy process is overloaded due to high SSL decryption demands.
Why it's wrong here
SSL decryption load is not high.
- ✗
Remote users are using an outdated browser that does not support modern protocols.
Why it's wrong here
Would affect local users too.
- ✓
The WSA is not configured to reuse TCP connections, causing high connection overhead for remote users.
Why this is correct
Connection reuse reduces latency.
- ✗
NTLM authentication is causing authentication delays over the MPLS link.
Why it's wrong here
NTLM is efficient and not causing delays.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.