Courseiva
mediumMultiple ChoiceObjective-mapped

350-701 Practice Question: During a security audit, it is discovered that…

During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?

⚠ Common exam trap

Cisco often tests the distinction between proxy enforcement (network-layer control) and proxy features (SSL decryption, authentication, URL filtering), leading candidates to mistakenly choose SSL decryption as the solution to a bypass problem.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA

In explicit proxy mode, the WSA only intercepts traffic that is explicitly configured to use it as a proxy. Users can bypass the proxy by configuring their browser or application to use a direct HTTPS connection (e.g., using CONNECT tunnels over port 443). To prevent this, a firewall rule must block all outbound HTTP/HTTPS traffic except traffic originating from the WSA's IP address, forcing all web traffic through the proxy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA

    Why this is correct

    This forces all web traffic through the proxy, preventing bypass.

  • Enable SSL decryption on the WSA

    Why it's wrong here

    SSL decryption only inspects decrypted traffic, does not force proxy use.

  • Configure identity-based authentication for all users

    Why it's wrong here

    Authentication ensures users are identified, but still allows bypass if traffic goes directly.

  • Create a custom URL category for tunneling websites and block them

    Why it's wrong here

    Tunneling can use any website, so blocking categories is ineffective.

About these practice questions

Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.