250-589 Sample Questions & Answers

In a transparent deployment, client devices are unaware of the proxy. Therefore, traffic must be redirected to the Edge SWG at the network level. This is typically done using methods like Web Cache Communication Protocol (WCCP) or Policy Based Routing (PBR) on a router or Layer 3 switch that sits in the traffic path. This device is configured to identify web traffic and forward it to the proxy for inspection. Manually configuring routes on unmanageable IoT devices is not feasible, and installing SSL certificates is a step for decryption, not initial interception.

VPM policies are evaluated from top to bottom, and the first matching rule determines the outcome. To create an exception, the more specific 'Allow' rule must be placed before the broader 'Deny' rule. A rule allowing access to 'corp-storage.com' should be first. Any request for that site will match this rule and be allowed, and policy processing for that layer stops. All other requests for sites in the 'Cloud Storage' category will not match the first rule, fall through to the second rule, and be denied. Placing the Deny rule first would block all cloud storage, including the allowed site.

The 'TCP-IP' health check specifically monitors the state of the networking stack, including the number of concurrent connections. A 'critical' status for this check typically means that the appliance is approaching or has reached its maximum configured limit for concurrent client connections. This indicates network pressure or a potential connection leak issue, but it is distinct from high CPU or memory usage, which are monitored by different health checks.

The sysinfo file is a critical diagnostic tool that generates a detailed, point-in-time report of the Edge SWG's entire state. This includes hardware status, SGOS version, licensing, network configuration, running configuration, performance statistics, and logs. It is the primary file requested by Symantec support for offline analysis of an appliance's health and configuration to diagnose complex issues.

To inspect the content of file uploads (HTTP POST requests), the Edge SWG must forward the data to a device capable of deep content inspection. The Content Analysis appliance serves this role. The standard protocol for this communication is the Internet Content Adaptation Protocol (ICAP). A policy on the Edge SWG would trigger an ICAP request to Content Analysis for matching uploads, which would then scan the content and return a verdict.

Adaptive Caching is an SGOS feature specifically designed to improve cache hit rates for content served by modern web applications. It intelligently identifies and ignores insignificant variations in request headers (like cookies or user-agent strings) that would normally cause the proxy to store multiple, identical copies of an object. By normalizing these requests, it stores a single, 'generic' version of the object that can be served to multiple users, significantly increasing cache efficiency.

In Edge SWG policy evaluation, processing occurs layer by layer, and within each layer, rule by rule from top to bottom. When a request matches the criteria of a rule that has a terminating action (like Allow or Deny), the decision is made, and policy evaluation for that specific layer concludes. The policy trace will show this final decision for the layer, indicated by 'MATCH'. The key is that the first match with a terminating action within a layer determines the outcome for that layer.

The Visual Policy Manager (VPM) allows for highly granular control over authentication. By creating a Web Authentication Layer, an administrator can define rules based on various criteria, including the source IP subnet. Two rules can be created: the first rule would match the guest VLAN subnet and trigger an action to authenticate using a captive portal (form-based) realm. The second rule would match the corporate subnet and trigger authentication using the IWA realm. This allows the Edge SWG to apply different authentication schemes based on the user's network location.

For successful integration, three key steps are required: 1) The Edge SWG must be configured with the IP address and port of the Reporter as a destination for the logs. 2) The log format used by the Edge SWG (e.g., bcreportermain_v1) must be recognized by the Reporter for correct parsing. 3) A client protocol (like FTP or HTTP) must be configured on the Edge SWG to periodically upload the log files to the Reporter appliance. A Log Facility is a Splunk term, and while secure logging is an option, it is not a mandatory requirement for basic functionality.

The SSL Access Layer is processed very early during the SSL handshake (after the Client Hello). At this stage, the Edge SWG has limited information, such as the destination IP and the Server Name Indication (SNI) from the client. Its primary purpose is to make a high-level decision on the connection itself—whether to intercept it for later inspection, tunnel it without inspection (bypass), or drop it entirely. It acts as a gatekeeper for encrypted connections before the more detailed Web Access Layer policies are applied.