How does a secure web gateway (SWG) protect users from web-based threats while still enforcing corporate acceptable use policies?

Question

Options

• AUsers are mapped via server logs for login events and syslog messages from authenticating
• BIt uses a cloud-based machine learning (ML)-powered web security engine to perform ML-based
• CIt prompts the browser to present a valid client certificate to authenticate the user.
• DUsers access the SWG, which then connects the user to the website while still performing

• A
  6% (4)
• B
  3% (2)
• C
  16% (10)
• D
  74% (46)

Explanation

Option D correctly captures the core function of an SWG: it acts as an inline proxy, meaning all web traffic flows through it. The SWG sits between the user and the internet, connecting on the user's behalf while simultaneously inspecting content, blocking malicious sites, and enforcing acceptable use policies in real time - all transparent to the user.

Why the distractors are wrong:

• A describes log aggregation and authentication event monitoring (more of a SIEM/syslog function), not active web traffic protection.
• B describes ML-based detection as a feature of some SWGs, but it's incomplete and describes one tool within an SWG, not how the SWG fundamentally operates.
• C describes mutual TLS/client certificate authentication, which is an identity verification method - not a web threat protection or policy enforcement mechanism.

Memory tip: Think of an SWG as a security tollbooth on the internet highway - every car (web request) must pass through it, get inspected, and only then is allowed to continue to its destination. The key word in option D is "while still performing" - protection happens during the connection, not before or after.

No community discussion yet for this question.