Free 250-589 sample questions

Correct answers: A Web Access Layer rule; A destination object using the 'Request URL Category'

To implement this policy, an administrator needs a Web Access Layer to define the traffic handling rule. The destination must be configured to match the 'Newly Registered Domains' category, which is provided by Symantec's categorization services. The action would then be set to trigger High Risk Isolation. A 'Threat Risk Level' object is for risk scores, not domain age, and an 'SSL Access Layer' is for controlling the initial SSL handshake, not for applying isolation based on content category.

Correct answer: Create a new job, attach the VPM policy file, and target the job to a device group containing only the European appliances.

Management Center is designed for centralized administration. The most efficient and scalable method is to organize appliances into logical groups (e.g., by region). A job can then be created to distribute the policy file specifically to the 'European' device group. This ensures targeted deployment without affecting other regions and provides a clear audit trail. Distributing to all devices is incorrect, and manual configuration defeats the purpose of centralized management.

Correct answer: False

This statement is false. In an ICAP integration, the Edge SWG acts as the ICAP client. It intercepts the traffic and, based on policy, forwards the content (e.g., a file download) to the Content Analysis appliance (the ICAP server). The Content Analysis appliance is the component that performs the actual malware scanning, sandboxing, and analysis, and then sends a response back to the Edge SWG indicating whether the content is clean or malicious.

Correct answer: Configure the upstream router or Layer 3 switch to redirect web traffic (port 80/443) to the Edge SWG appliance.

In a transparent deployment, client devices are unaware of the proxy. Therefore, traffic must be redirected to the Edge SWG at the network level. This is typically done using methods like Web Cache Communication Protocol (WCCP) or Policy Based Routing (PBR) on a router or Layer 3 switch that sits in the traffic path. This device is configured to identify web traffic and forward it to the proxy for inspection. Manually configuring routes on unmanageable IoT devices is not feasible, and installing SSL certificates is a step for decryption, not initial interception.

Correct answer: Create a rule to Allow 'corp-storage.com', and a second, subsequent rule to Deny the 'Cloud Storage' category.

VPM policies are evaluated from top to bottom, and the first matching rule determines the outcome. To create an exception, the more specific 'Allow' rule must be placed before the broader 'Deny' rule. A rule allowing access to 'corp-storage.com' should be first. Any request for that site will match this rule and be allowed, and policy processing for that layer stops. All other requests for sites in the 'Cloud Storage' category will not match the first rule, fall through to the second rule, and be denied. Placing the Deny rule first would block all cloud storage, including the allowed site.

Correct answer: The number of active concurrent client connections has reached a configured limit.

The 'TCP-IP' health check specifically monitors the state of the networking stack, including the number of concurrent connections. A 'critical' status for this check typically means that the appliance is approaching or has reached its maximum configured limit for concurrent client connections. This indicates network pressure or a potential connection leak issue, but it is distinct from high CPU or memory usage, which are monitored by different health checks.

Correct answer: To provide a comprehensive snapshot of the appliance's configuration, statistics, and system state for analysis.

The `sysinfo` file is a critical diagnostic tool that generates a detailed, point-in-time report of the Edge SWG's entire state. This includes hardware status, SGOS version, licensing, network configuration, running configuration, performance statistics, and logs. It is the primary file requested by Symantec support for offline analysis of an appliance's health and configuration to diagnose complex issues.

Correct answer: Content Analysis using ICAP

To inspect the content of file uploads (HTTP POST requests), the Edge SWG must forward the data to a device capable of deep content inspection. The Content Analysis appliance serves this role. The standard protocol for this communication is the Internet Content Adaptation Protocol (ICAP). A policy on the Edge SWG would trigger an ICAP request to Content Analysis for matching uploads, which would then scan the content and return a verdict.

Correct answer: Adaptive Caching

Adaptive Caching is an SGOS feature specifically designed to improve cache hit rates for content served by modern web applications. It intelligently identifies and ignores insignificant variations in request headers (like cookies or user-agent strings) that would normally cause the proxy to store multiple, identical copies of an object. By normalizing these requests, it stores a single, 'generic' version of the object that can be served to multiple users, significantly increasing cache efficiency.

Correct answer: When a rule with a terminating action (e.g., Deny, Allow) is matched, causing evaluation for that layer to stop.

In Edge SWG policy evaluation, processing occurs layer by layer, and within each layer, rule by rule from top to bottom. When a request matches the criteria of a rule that has a terminating action (like Allow or Deny), the decision is made, and policy evaluation for that specific layer concludes. The policy trace will show this final decision for the layer, indicated by 'MATCH'. The key is that the first match with a terminating action within a layer determines the outcome for that layer.