hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A multinational company has recently deployed…
A multinational company has recently deployed Cisco WSA with explicit proxy for 10,000 users across two data centers. The WSA is configured with multiple identities based on IP subnets and authentication via LDAP. Users in the R&D department (subnet 192.168.10.0/24) are configured with an access policy that blocks all social media, but they can access web-based email like Gmail. The administrator receives complaints that R&D users cannot access a critical partner's HTTPS website (https://portal.partner.com) that is not categorized. The access policy for R&D has a default action of 'Monitor' for uncategorized URLs, but the site is blocked. The web reputation score for the site is +1.5 (low risk). The global web reputation threshold is set to -1.0. The administrator checks the access logs and sees that the request is denied with the reason 'URL is blocked by policy'. The R&D policy has an explicit 'Deny' action for the URL category 'Uncategorized URLs' set to 'Block', but the default action for the policy is 'Monitor'. The identity matching is correct. What is the most likely cause and solution?
⚠ Common exam trap
Cisco often tests the concept that explicit policy actions for a URL category override the default action, leading candidates to incorrectly assume the default 'Monitor' action would allow the traffic when an explicit 'Deny' is present.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom URL category for portal.partner.com and configure the R&D policy to allow it.
The R&D access policy has an explicit 'Deny' action for the 'Uncategorized URLs' category, which overrides the default 'Monitor' action. Since portal.partner.com is uncategorized, it is blocked by this explicit deny. Creating a custom URL category for the partner site and configuring an explicit 'Allow' action in the R&D policy will bypass the uncategorized URL block while preserving the rest of the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the R&D policy's Uncategorized URLs action from Block to Monitor.
Why it's wrong here
This would allow all uncategorized sites, weakening security.
- ✗
Lower the global web reputation threshold to -2.0 to allow more sites.
Why it's wrong here
The site has good reputation, threshold is not blocking it.
- ✓
Create a custom URL category for portal.partner.com and configure the R&D policy to allow it.
Why this is correct
Custom allow rule overrides the category block.
- ✗
Disable authentication for the R&D identity to bypass policy.
Why it's wrong here
Authentication is not the cause and disabling it may break other functions.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.