Symantec Web Protection—Edge SWG R2 Technical Specialist Free Sample Questions

Mutual TLS (mTLS) requires both the client and server to present valid certificates. SSL interception breaks this process because the Edge SWG presents its own emulated certificate to the client. The correct solution is to bypass interception for this specific traffic. Using the Server Certificate Common Name in the SSL Interception Layer is a precise and secure way to create this bypass, ensuring only the intended application traffic is excluded from inspection. Installing the client's private key on the proxy is a significant security risk, and disabling protocol detection is too broad and may have unintended consequences.

For IWA to function transparently, the client browser must recognize the proxy as part of the Local Intranet zone. This setting allows the browser to automatically send the user's Kerberos ticket with the request. If the proxy's hostname or IP is not in this zone, the browser will treat it as an external site and will not send the authentication ticket, resulting in a credential prompt. While time sync issues and incorrect SPNs can cause IWA failures, the lack of a Kerberos ticket in the initial request points directly to a client-side zone configuration problem.

To implement this policy, an administrator needs a Web Access Layer to define the traffic handling rule. The destination must be configured to match the 'Newly Registered Domains' category, which is provided by Symantec's categorization services. The action would then be set to trigger High Risk Isolation. A 'Threat Risk Level' object is for risk scores, not domain age, and an 'SSL Access Layer' is for controlling the initial SSL handshake, not for applying isolation based on content category.

Management Center is designed for centralized administration. The most efficient and scalable method is to organize appliances into logical groups (e.g., by region). A job can then be created to distribute the policy file specifically to the 'European' device group. This ensures targeted deployment without affecting other regions and provides a clear audit trail. Distributing to all devices is incorrect, and manual configuration defeats the purpose of centralized management.

This statement is false. In an ICAP integration, the Edge SWG acts as the ICAP client. It intercepts the traffic and, based on policy, forwards the content (e.g., a file download) to the Content Analysis appliance (the ICAP server). The Content Analysis appliance is the component that performs the actual malware scanning, sandboxing, and analysis, and then sends a response back to the Edge SWG indicating whether the content is clean or malicious.

In a transparent deployment, client devices are unaware of the proxy. Therefore, traffic must be redirected to the Edge SWG at the network level. This is typically done using methods like Web Cache Communication Protocol (WCCP) or Policy Based Routing (PBR) on a router or Layer 3 switch that sits in the traffic path. This device is configured to identify web traffic and forward it to the proxy for inspection. Manually configuring routes on unmanageable IoT devices is not feasible, and installing SSL certificates is a step for decryption, not initial interception.

VPM policies are evaluated from top to bottom, and the first matching rule determines the outcome. To create an exception, the more specific 'Allow' rule must be placed before the broader 'Deny' rule. A rule allowing access to 'corp-storage.com' should be first. Any request for that site will match this rule and be allowed, and policy processing for that layer stops. All other requests for sites in the 'Cloud Storage' category will not match the first rule, fall through to the second rule, and be denied. Placing the Deny rule first would block all cloud storage, including the allowed site.

The 'TCP-IP' health check specifically monitors the state of the networking stack, including the number of concurrent connections. A 'critical' status for this check typically means that the appliance is approaching or has reached its maximum configured limit for concurrent client connections. This indicates network pressure or a potential connection leak issue, but it is distinct from high CPU or memory usage, which are monitored by different health checks.

The sysinfo file is a critical diagnostic tool that generates a detailed, point-in-time report of the Edge SWG's entire state. This includes hardware status, SGOS version, licensing, network configuration, running configuration, performance statistics, and logs. It is the primary file requested by Symantec support for offline analysis of an appliance's health and configuration to diagnose complex issues.

To inspect the content of file uploads (HTTP POST requests), the Edge SWG must forward the data to a device capable of deep content inspection. The Content Analysis appliance serves this role. The standard protocol for this communication is the Internet Content Adaptation Protocol (ICAP). A policy on the Edge SWG would trigger an ICAP request to Content Analysis for matching uploads, which would then scan the content and return a verdict.