Which option describes the Cisco best practice for using authentication-based access policies?

Question

Options

• AIt should be used as the Global Policy.
• BIt should be used above nonauthentieating access policies in the Web Security Manager/Access
• CIt should be used below nonauthentieating access policies in the Web Security Manager/Access
• DIt should be used as the only policy.

• A
  5% (2)
• B
  93% (41)
• D
  2% (1)

Explanation

Authentication-based access policies must be placed above non-authenticating policies in the Web Security Manager/Access Policies list because Cisco WSA evaluates policies top-to-bottom - the first match wins. If a non-authenticating policy sits higher in the list, authenticated users could match it before ever reaching the policy that enforces credentials, effectively bypassing authentication entirely.

Why the distractors are wrong:

• A (Global Policy): The Global Policy is a catch-all at the bottom of the list; it applies when no other policy matches and is not the right place for targeted authentication enforcement.
• C (below non-authenticating): This is the opposite of best practice - placing auth-based policies below non-authenticating ones allows unauthenticated traffic to match first and skip credential checks.
• D (only policy): There is no requirement to use authentication-based policies exclusively; mixed environments with both authenticated and non-authenticated policies are common and valid.

Memory tip: Think of authentication as a bouncer - the bouncer (auth policy) must stand at the front of the line (top of the list), not behind staff who wave people through without checking IDs (non-authenticating policies).

No community discussion yet for this question.