Which option describes the Cisco best practice for configuration of the Web Usage Control feature?

Question

Options

• ATo configure the Global Policy as the most restrictive
• BTo configure the Global Policy as the least restrictive
• CTo configure every access policy using the inherited attributes from the Global Policy
• DTo leave all actions in the Global Policy set to Monitor

• A
  8% (5)
• B
  3% (2)
• C
  87% (53)
• D
  2% (1)

Explanation

Option C is correct because Cisco's best practice for Web Usage Control on the WSA (Web Security Appliance) is to configure the Global Policy as your baseline, then let individual access policies inherit those URL category actions - overriding only where a specific group needs different treatment. This inheritance model reduces redundant configuration, ensures consistent enforcement, and simplifies ongoing management.

Why the distractors are wrong:

• A is partially misleading - while a restrictive Global Policy is sometimes recommended, it is not the stated best practice specifically for WUC configuration; the emphasis is on the inheritance model, not the strictness level.
• B is incorrect; making the Global Policy the least restrictive would mean specific access policies would need to be more restrictive than their parent, which inverts the intended inheritance logic.
• D is incorrect; leaving all actions set to Monitor means no traffic is actually blocked or filtered - you'd have visibility but zero enforcement, which is not a production best practice.

Memory tip: Think "Global = Template, Access Policies = Children." Children inherit from the parent (Global Policy) unless told otherwise - just like in object-oriented programming. If you find yourself reconfiguring the same WUC settings in every access policy, you're doing it wrong.

No community discussion yet for this question.