An organization conducts research on the benefits of leveraging the Web Proxy feature of PAN- OS 11.0. What are two benefits of using an explicit proxy method versus a transparent proxy method?…

Question

Options

• ANo client configuration is required for explicit proxy, which simplifies the deployment complexity.
• BExplicit proxy supports interception of traffic using non-standard HTTPS ports.
• CIt supports the X-Authenticated-User (XAU) header, which contains the authenticated username
• DExplicit proxy allows for easier troubleshooting, since the client browser is aware of the existence

• A
  9% (2)
• B
  5% (1)
• C
  86% (19)

Explanation

C and D are correct because they describe genuine advantages unique to explicit proxy. In explicit proxy mode, the client browser is intentionally configured to know the proxy exists - this awareness enables richer authentication integration, including the X-Authenticated-User (XAU) header (C), which passes the authenticated username to downstream systems. That same client awareness also makes troubleshooting easier (D), since the browser can surface proxy-specific errors rather than appearing as generic connection failures.

A is wrong because it describes the opposite reality - it is transparent proxy that requires no client configuration, since traffic is intercepted silently without the client's knowledge. Explicit proxy always requires browser or system-level configuration.

B is wrong because intercepting traffic on non-standard HTTPS ports is a strength of transparent proxy, which can intercept all TCP traffic regardless of port. Explicit proxy typically handles standard proxy ports (e.g., 8080) and relies on the client sending traffic to it directly.

Memory tip: Think "Explicit = the client knows the proxy exists." That single fact cascades into both correct answers - if the client knows the proxy is there, it can authenticate through it (XAU header) and report errors clearly (easier troubleshooting). If a choice says "no client config needed," that's always transparent proxy territory.

No community discussion yet for this question.