What does the appearance of the ACL tag BLOCK_WBRS in the access log mean?

Question

Options

• AYour appliance or the WBRS key is out of support.
• BThe proxy blocked an outbound request because the client is infected with malware
• CThe proxy blocked access to a site because of a suspicious server response.
• DThe proxy blocked access to a site with a low reputation score.

• A
  3% (1)
• B
  6% (2)
• C
  3% (1)
• D
  88% (28)

Explanation

WBRS stands for Web-Based Reputation Score - a numerical rating Cisco's Web Security Appliance (WSA) assigns to websites based on threat intelligence. When the ACL tag BLOCK_WBRS appears in the access log, it means the WSA denied access because the destination site's reputation score fell below the configured acceptable threshold, making D correct.

• A is wrong because license/support expiration would generate a system alert or warning, not a per-request ACL block tag in the access log.
• B is wrong because blocking outbound traffic from an infected client is the job of malware scanning (e.g., BLOCK_AMW), not a reputation-based check on the destination site.
• C is wrong because suspicious server responses (e.g., malicious content in the reply) are caught by response scanning - a separate mechanism - not by WBRS, which evaluates the site's reputation before content is served.

Memory tip: Break down the tag - BLOCK + WBRS (Web-Based Reputation Score) = "blocked because the site's reputation was too low." If you see WBRS in any Cisco WSA context, think reputation score, not malware detection or response content.

No community discussion yet for this question.