BCCPP Sample Questions & Answers

The correct syntax uses an action.Redirect object. It's best practice to match on url.domain rather than url.host to be less specific. The action requires the redirect code (e.g., 301 for permanent), the new URL, and optionally, a variable like $(url.query) to preserve any query strings from the original request. The other options use incorrect actions (action.Forward), incorrect syntax, or less precise matching.

This is the most direct and efficient method. A Web Content Layer is the appropriate place for content-based decisions. The rule can be precisely targeted using a Request Method object for POST requests. The action would then be to send the request to an integrated Content Analysis System (CAS) via ICAP for scanning. The CAS is designed to detect threats like SQL injection and can instruct the ProxySG to block the request if a threat is found.

HTTP workers are responsible for handling client requests, fetching objects from origin servers, and serving them. A low cache hit rate means workers are frequently going to the origin server, which is a CPU-intensive process involving DNS lookups, TCP handshakes, and data transfer. By optimizing caching policies to increase the hit rate, more objects will be served directly from the ProxySG's disk or RAM cache. This significantly reduces the workload on the HTTP workers, leading to lower CPU utilization and improved latency.

The Visual Policy Manager (VPM) only displays policies created through its interface. It is possible to have CPL code from other sources (like the Local Policy File, a Forwarding Policy File, or CPL layers added via the CLI) that is processed by the SGOS policy engine but is not represented in the VPM GUI. If a trace shows a denial but no corresponding rule is visible in any VPM layer, the most common cause is a rule in one of these non-VPM CPL sources.

This is the standard and most effective method. The SSL Interception Layer is processed specifically for SSL/TLS handshakes. By placing a 'Do Not Intercept' (bypass) rule at the top for the sensitive healthcare domains, you ensure that traffic is tunneled without decryption. The second, more general 'Intercept' rule then catches all other traffic that did not match the first rule. This top-down processing logic is fundamental to VPM policy evaluation.

Kerberos constrained delegation with protocol transition (S4U2proxy) requires very specific configuration in Active Directory. The account under which the ProxySG service runs must be trusted for delegation, but only to specific services (the downstream web application's SPN). Crucially, the 'Use any authentication protocol' option must be selected for that delegation entry. This enables Protocol Transition, allowing the ProxySG to take a user's credential from a non-Kerberos authentication method (like basic or NTLM) and transition it to a Kerberos ticket for the backend service.

This is a common and effective design pattern. The IWA realm is configured to authenticate users. If authentication succeeds, the user is identified as a staff member and their group memberships can be used in policy. If authentication fails for any reason (e.g., the user is on a non-domain machine), the 'fail open' configuration allows the connection to proceed, but without an authenticated user identity. Subsequent policy layers can then use the condition user.authenticated=false to identify these users as guests and apply the more restrictive filtering policy.

VRRP provides Layer 3 failover by transferring a virtual IP address from the master to the backup unit. However, it does not synchronize Layer 4 connection state information. When the master fails, the backup takes over the VIP, but it has no knowledge of the TCP sessions that were established with the master. Therefore, all existing connections are broken and client applications (like web browsers) must initiate new TCP connections to the virtual IP, which will now be handled by the newly active proxy.

The forwarding policy file is the correct mechanism for making dynamic, policy-based decisions about where to send traffic. By defining forwarding hosts for the EU and US proxies, an administrator can write rules that use the client.address condition to match traffic originating from the known IP subnets of the EU and US offices. This allows the ProxySG to direct traffic to the geographically appropriate upstream proxy, thereby satisfying the data sovereignty requirement.

REFRESH_SERV_IMS specifically means the proxy is performing a refresh by sending a request to the origin server with an If-Modified-Since (IMS) header. This happens when the object is present in the cache, but its Time-To-Live (TTL) has expired according to the caching rules. Instead of downloading the full object again, it asks the server if the object has changed since it was last cached. If the server responds with a 304 Not Modified, the proxy serves the cached object and resets its TTL. If the server provides a new object, the proxy caches it and serves it to the client.