The answer is that the WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request. In transparent proxy mode, the proxy intercepts traffic without the client being aware, so each new TCP connection between the browser and the WSA triggers a fresh NTLM challenge-response handshake. Without persistent connection settings—such as enabling HTTP keepalive or connection reuse—the browser must re-authenticate for every request, leading to intermittent credential prompts when some connections are reused and others are not. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of how NTLM authentication behaves differently in transparent versus explicit proxy modes; a common trap is assuming the issue is with the domain controller or user credentials rather than the proxy’s connection handling. Remember the memory tip: “No keepalive, no NTLM survival”—persistent connections are essential to avoid repeated prompts.
350-701 Content Security Practice Question
This 350-701 practice question tests your understanding of content security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Cisco Web Security Appliance (WSA) with transparent proxy mode. Recently, they enabled NTLM authentication. Some users are intermittently prompted for credentials while browsing. What is the most likely cause of this behavior?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request.
In transparent proxy mode with NTLM authentication, the WSA must maintain persistent connections to avoid re-authentication on every HTTP request. If the WSA is not configured to handle NTLM persistent connections (e.g., by enabling connection reuse or adjusting keepalive settings), the browser will be prompted repeatedly for credentials because each new TCP connection triggers a new NTLM challenge-response cycle. This intermittent behavior occurs because some connections may be reused while others are not, depending on browser and proxy settings.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The WSA is configured to prompt for authentication only for specific categories.
Why it's wrong here
Intermittent prompts are not typical for category-based prompting.
✗
The user's browser has cached an incorrect credential.
Why it's wrong here
Cached credentials should not cause intermittent prompts; they would either work or fail.
✗
The WSA is set to use Kerberos instead of NTLM.
Why it's wrong here
Kerberos is more efficient but requires domain integration; if only NTLM is configured, Kerberos should not be tried.
✓
The WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request.
Why this is correct
Without persistent connections, each HTTP request may trigger a new NTLM challenge, leading to prompts.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between authentication protocol selection (Kerberos vs. NTLM) and the underlying transport behavior (persistent vs. non-persistent connections), leading candidates to incorrectly blame the protocol type rather than connection handling.
Detailed technical explanation
How to think about this question
NTLM authentication over HTTP relies on a three-step handshake (negotiate, challenge, authenticate) that must occur within a single TCP connection. When the WSA terminates connections prematurely or does not support HTTP/1.1 keepalive properly, each new request opens a fresh TCP connection, forcing the browser to repeat the entire NTLM handshake. In real-world deployments, this is often resolved by enabling 'connection pooling' or 'persistent connection support' on the WSA and ensuring the browser's HTTP version and keepalive settings align with the proxy's configuration.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-701 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Content Security — This question tests Content Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request. — In transparent proxy mode with NTLM authentication, the WSA must maintain persistent connections to avoid re-authentication on every HTTP request. If the WSA is not configured to handle NTLM persistent connections (e.g., by enabling connection reuse or adjusting keepalive settings), the browser will be prompted repeatedly for credentials because each new TCP connection triggers a new NTLM challenge-response cycle. This intermittent behavior occurs because some connections may be reused while others are not, depending on browser and proxy settings.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.