TRR and TRT are associated with which WSA component?

The correct answer is B. Anti-Malware. TRR (Threat Risk Rating) and TRT (Threat Risk Threshold) are metrics used by the Anti-Malware component of the Cisco Web Security Appliance (WSA). The scanning engine (Sophos or McAfee) assigns each scanned object a TRR score; if that score exceeds the administrator-configured…

Describe Cisco Web Security Solutions

Question

Options

AL4TM
BAnti-Malware
CURL Filters
DWeb Reputation

How the community answered

(14 responses)

A
7% (1)
B
93% (13)

Explanation

TRR (Threat Risk Rating) and TRT (Threat Risk Threshold) are metrics used by the Anti-Malware component of the Cisco Web Security Appliance (WSA). The scanning engine (Sophos or McAfee) assigns each scanned object a TRR score; if that score exceeds the administrator-configured TRT, the content is blocked - making both values core to Anti-Malware policy enforcement.

Why the distractors are wrong:

A (L4TM): Layer 4 Traffic Monitor watches raw TCP/UDP connections for botnet activity; it has no TRR/TRT scoring framework.
C (URL Filters): URL Filtering works with category-based access policies, not numeric threat risk scores.
D (Web Reputation): Web Reputation uses its own score called WBRS (Web-Based Reputation Score), which is a separate metric from TRR/TRT.

Memory tip: Think "Rating vs. Threshold = Anti-Malware's Rulebook." TRR is what the engine rates a file, TRT is the trigger you set - both belong exclusively to the Anti-Malware scanning workflow, not to URL or reputation systems.

Topics

#Anti-Malware#Threat Risk Rating#Risk Assessment#WSA Components

Community Discussion

No community discussion yet for this question.

Full 700-281 Practice