mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: During a security audit, it is discovered that…
During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?
⚠ Common exam trap
Cisco often tests the distinction between proxy enforcement (network-layer control) and proxy features (SSL decryption, authentication, URL filtering), leading candidates to mistakenly choose SSL decryption as the solution to a bypass problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA
In explicit proxy mode, the WSA only intercepts traffic that is explicitly configured to use it as a proxy. Users can bypass the proxy by configuring their browser or application to use a direct HTTPS connection (e.g., using CONNECT tunnels over port 443). To prevent this, a firewall rule must block all outbound HTTP/HTTPS traffic except traffic originating from the WSA's IP address, forcing all web traffic through the proxy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA
Why this is correct
This forces all web traffic through the proxy, preventing bypass.
- ✗
Enable SSL decryption on the WSA
Why it's wrong here
SSL decryption only inspects decrypted traffic, does not force proxy use.
- ✗
Configure identity-based authentication for all users
Why it's wrong here
Authentication ensures users are identified, but still allows bypass if traffic goes directly.
- ✗
Create a custom URL category for tunneling websites and block them
Why it's wrong here
Tunneling can use any website, so blocking categories is ineffective.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.