Which two protocols must be configured to authenticate end users to the Cisco WSA? (Choose two.)

NTLMSSP (NT LAN Manager Security Support Provider) is a common protocol used by Windows systems for authentication, enabling the Cisco WSA to authenticate users against a Windows domain.

Kerberos is the default authentication protocol for Active Directory and is used by the Cisco WSA for secure, transparent user authentication within a Windows domain environment, offering a more secure alternative to NTLM.

CHAP (Challenge-Handshake Authentication Protocol) is an older authentication protocol primarily used for PPP connections, not for authenticating end users to a web proxy like the WSA.

TACACS+ is primarily used for authenticating network device administrators, not for authenticating end users accessing web resources through a WSA.

RADIUS is typically used for network access authentication or for VPN users, but NTLMSSP and Kerberos are the primary protocols for transparent authentication of enterprise users to a Cisco WSA, especially in Active Directory environments.