Cisco Secure Web Appliance Deployment Modes

350-701 By islever Editorial Last updated

Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities

Short answer

BD Onsite web proxy services and Layer 4 traffic monitoring are not available in Cloud Web Security Connector mode.

Question

Which two facts must be considered when deciding whether to deploy the Cisco Secure Web Appliance in Standard mode, Hybrid Web Security mode, or Cloud Web Security Connector mode? (Choose two.)
  1. External DLP is available only in Standard mode and Hybrid Web Security mode.
  2. The onsite web proxy is not supported in Cloud Web Security Connector mode. Correct Answer
  3. Standard mode and Hybrid Web Security mode perform the same actions in response to the application of an individual policy.
  4. Only Standard mode and Hybrid Web Security mode support Layer 4 traffic monitoring. Correct Answer
  5. ISE integration is available only in Standard mode and Hybrid Web Security mode.

Key Takeaways

The question tests knowledge of feature availability across WSA deployment modes, with the common trap being confusion about which capabilities are exclusive to on-premises or hybrid deployments versus cloud-only connectors.

This page explains the differences between Standard, Hybrid, and Cloud Web Security Connector modes for Cisco Secure Web Appliance (WSA), establishing that on-site proxy and Layer 4 traffic monitoring are unavailable in Connector mode.

Common mistake: Many candidates incorrectly select options regarding External DLP or ISE integration, failing to realize that while these features exist in Standard/Hybrid modes, they are not the primary differentiators defining the deployment architecture constraints like proxy support.

Expert Analysis

Why the Answer Is Correct

The correct answers are B and D. The Cisco Secure Web Appliance documentation explicitly states that deployment is similar across modes, but Cloud Web Security Connector mode lacks two specific capabilities found in Standard and Hybrid modes: the onsite web proxy service and Layer-4 Traffic Monitor services. This architectural limitation makes B and D factual requirements when deciding between these modes.

Why the Other Options Are Wrong

Option A is incorrect because while External DLP is supported in Standard and Hybrid modes, it is not the defining constraint for deployment mode selection in the same way as core proxy functionality; furthermore, some sources suggest DLP might have varying support levels, but the definitive missing features are proxy and L4TM. Option C is false because Standard and Hybrid modes do not necessarily perform identical actions; Hybrid mode syncs policies with Umbrella SIG, altering enforcement logic. Option E is incorrect because ISE integration is not restricted solely to Standard and Hybrid modes in a way that defines the deployment choice compared to the fundamental lack of proxy services in Connector mode.

Community Comment Notes

Community consensus strongly supports B and D. As noted by user aa4a63c, "Deployment of the appliance is the same in both standard and Cloud Security mode except that on-site web proxy services and Layer-4 Traffic Monitor services are not available in Cloud Web Security Connector mode." User 3ab324f reinforced this by citing the official AsyncOS User Guide chapter confirming these exclusions. Multiple users highlighted that these two limitations are the key differentiators.

Official Reference

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_01000.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

When comparing deployment modes, focus on what is missing from the cloud-only option rather than just listing features present in all. Identify core infrastructure components (like local proxies) that cannot exist in a pure cloud connector model.

Frequently Asked Questions

Why is External DLP not the correct answer?

While External DLP is supported in Standard and Hybrid modes, the exam focuses on the fundamental architectural limitations of the Connector mode, specifically the lack of local proxy and L4 monitoring capabilities.

Does Hybrid mode use the same proxy as Standard?

No, Hybrid mode uses the WSA appliance locally but synchronizes policies with Cisco Umbrella SIG, whereas Standard mode operates independently on-premises without that specific cloud policy sync dependency.

More 350-701 FAQ →

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. aa4a63c 👍 6
    Deployment of the appliance is the same in both standard and Cloud Security mode except that on-site web proxy services and Layer-4 Traffic Monitorservices are not available in Cloud WebSecurity Connector mode.
  2. ITVI 👍 3
    Standard Mode: On-site web proxy and Layer-4 traffic monitoring are available. Offers External Data Loss Prevention (DLP) capabilities. Supports ISE integration. Requires physical or virtual appliance deployment. Hybrid Mode: Combines SWA with Cisco Umbrella SIG for policy synchronization. Enforces the same web policies across on-premises and cloud environments. Offers granular policy management through Umbrella SIG. Requires both SWA and Cisco Umbrella SIG. Cloud Web Security Connector: Routes traffic to a CWS proxy for policy enforcement. On-site web proxy and Layer-4 traffic monitoring are not available. Requires no on-site appliance. Does not support native FTP or HTTPS decryption.
  3. 3ab324f 👍 3
    I mean B and D of course, just mistyping
  4. madboy2 👍 2
    A. External DLP is available only in Standard mode and Hybrid Web Security mode. Data Loss Prevention (DLP) is a critical security feature that monitors and prevents sensitive data exfiltration. External DLP integration (e.g., with third-party DLP solutions) is only supported in Standard Mode and Hybrid Web Security Mode. Cloud Web Security Connector Mode does not support external DLP since it relies on Cisco's cloud-based security services. B. The onsite web proxy is not supported in Cloud Web Security Connector mode. Cloud Web Security Connector Mode forwards web traffic directly to Cisco Umbrella or Cisco Cloud Web Security (CWS), bypassing on-premise proxies. No local proxy is used in this mode because all security processing happens in the cloud. In Standard Mode and Hybrid Mode, the WSA acts as a local proxy for deeper content inspection and policy enforcement.
  5. 3ab324f 👍 2
    BC with reference to: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_01000.pdf Deployment of the appliance is the same in both standard and Cloud Security mode except that on-site web proxy services and Layer-4 Traffic Monitor services are not available in Cloud Web Security Connector mode.
Show 6 more comments
  1. NETeng01 👍 2
    i thnik it's A and B The official Cisco documentation for the Secure Web Appliance confirms that External DLP (Data Loss Prevention) is available only in Standard mode and Hybrid Web Security mode. This is typically found in the feature comparison tables or deployment sections of the AsyncOS User Guides for Cisco Secure Web Appliance.
  2. Silexis 👍 1
    This document says all: On-site and L4TM are not available in Connector Mode while you can integrate External DLP (page 6). Correct answers B&D https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-5/user_guide/b_WSA_UserGuide_11_5_1/b_WSA_UserGuide_11_5_1_chapter_010.pdf
  3. XBfoundX 👍 1
    Deployment of the appliance is the same in both standard and Cloud Security mode except that on-site web proxy services and Layer-4 Traffic Monitor services are not available in Cloud Web Security Connector mode.
  4. XBfoundX 👍 1
    https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa-15-0/user-guide/wsa-userguide-15-0/b_WSA_UserGuide_11_7_chapter_010.html
  5. NETeng01 👍 1
    From your explanation D it's not correct , Cloud Web Security Connector don't support traffic monitoring
  6. NETeng01 👍 1
    i mean Hybrid Web Security mode

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide