700-281 · Question #15
Drag and Drop Question Put the following features in the order they are applied. Answer:
The correct answer is Protocol check; URL Filters; Web Reputation Filters; McAfee anti-malware scanning. Web Security Gateway: Order of Feature Application This question covers how a web security gateway (e.g., Cisco WSA or McAfee Web Gateway) processes traffic. The ordering follows a least-expensive-first principle - eliminate traffic early using cheap checks before committing to…
Question
Drag and Drop Question Put the following features in the order they are applied. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- Protocol check
- URL Filters
- Web Reputation Filters
- McAfee anti-malware scanning
Explanation
Web Security Gateway: Order of Feature Application
This question covers how a web security gateway (e.g., Cisco WSA or McAfee Web Gateway) processes traffic. The ordering follows a least-expensive-first principle - eliminate traffic early using cheap checks before committing to costly ones.
1. Protocol Check (First)
Why first: Protocol inspection is the lightest possible check. The gateway verifies whether the protocol itself (HTTP, HTTPS, FTP, etc.) is permitted before doing anything else.
- No payload analysis required
- If the protocol is blocked, the connection is dropped immediately, saving all downstream processing
- Makes no sense to check a URL's reputation if the protocol is outright disallowed
2. URL Filters (Second)
Why second: URL categorization (gambling, adult content, known-bad domains) uses static or pre-cached lists - fast lookups with no content inspection.
- Still cheap compared to reputation lookups or scanning
- Eliminates a large portion of unwanted traffic before hitting dynamic or compute-heavy checks
- A blocked URL category needs no further analysis
3. Web Reputation Filters (Third)
Why third: Reputation scoring is dynamic - it queries threat intelligence services for a site's trust score based on behavior, history, and associations.
- More sophisticated than static URL lists but more expensive (requires external/cloud lookup)
- Only runs on traffic that passed the protocol and URL checks
- Can block borderline or newly malicious sites that aren't yet in URL filter lists
4. McAfee Anti-Malware Scanning (Last)
Why last: This is the most computationally expensive step - the gateway must receive and inspect the actual content/payload byte-by-byte.
- Requires buffering or streaming the response body
- CPU and memory intensive
- Only applied to traffic that passed all prior filters, minimizing load
- Catches malware embedded in otherwise "trusted" or unblocked sites
Common Mistakes
| Mistake | Why It's Wrong |
|---|---|
| Putting malware scanning first | Scanning all raw traffic is prohibitively expensive; filters should narrow the scope first |
| Swapping URL Filters and Web Reputation | URL filters use static lists (faster); reputation requires dynamic lookups (slower) - static before dynamic |
| Putting protocol check after URL filtering | Pointless to evaluate a URL if the protocol would be blocked anyway |
Key mental model: Think of it as a funnel - each stage is progressively more expensive and handles progressively less traffic.
Topics
Community Discussion
No community discussion yet for this question.