Web Filtering

Question 1 of 6

An organization's security policy states: Educational websites = Allow; Home and Garden websites = Allow and log an alert; Gambling websites = Block. A user requests a page on a gambling site. What happens, and which web filtering feature produces this behavior?

DNS filtering returns no IP address for the gambling site, preventing a TCP connection from being established Category-based block rules with per-category dispositions — the URL filter identifies the site's category as Gambling, matches the Block disposition, and returns a block page to the user Agent-based filtering on the user's device evaluates the URL locally and refuses the connection Reputation filtering assigns the site a High Risk score and blocks it automatically without consulting category rules

Question 2 of 6

A company's employees work from home, travel internationally, and connect to untrusted public Wi-Fi. The CISO requires web filtering that is always active regardless of which network the employee uses, without requiring a VPN connection to the corporate network. Which technology is BEST suited?

A forward proxy deployed on the corporate internal network URL filtering integrated into the perimeter NGFW Agent-based content filtering installed on each user's device, managed from a central console with cloud-based URL category updates DNS filtering pointing all users to a corporate DNS resolver

Question 3 of 6

A user's browser is configured with no special settings. The user requests a web page. Unknown to the user, the network silently routes the request through an inspection device that scans the response for malware before delivering it. No configuration was required on the user's workstation. What type of proxy is this?

An explicit proxy — the browser is configured to send requests to the proxy's address and port A transparent proxy — it intercepts traffic without requiring any client-side configuration; the user is unaware their traffic is being proxied An agent-based filter — client software on the device is performing the inspection silently in the background A reverse proxy — the proxy sits in front of the web server rather than in front of the user

Question 4 of 6

An endpoint is infected with malware that attempts to contact its command-and-control (C2) server. The malware performs a DNS lookup for the C2 domain. The organization uses DNS filtering with a real-time threat intelligence feed. What happens, and why is DNS filtering effective against this threat?

DNS filtering is ineffective here because it only controls browser-based HTTP and HTTPS traffic, not malware DNS lookups The NGFW's IPS detects the DNS request as anomalous and blocks it using signature-based detection The DNS filtering server recognizes the C2 domain on its blocklist, returns no IP address, and the malware cannot establish a connection — DNS filtering applies to all DNS lookups, not just web browsing The transparent proxy intercepts the DNS request, inspects the payload, and blocks the malware from making an outbound connection

Question 5 of 6

An automated reputation system scores a newly discovered website as “High Risk.” A security administrator reviews the site and determines it is a legitimate security research blog operated by a trusted vendor. What should the administrator do, and what feature enables this?

The administrator cannot change the score; automated reputation systems are the authoritative source and manual overrides are not permitted The administrator should disable the entire reputation filtering feature to avoid blocking the vendor blog The administrator manually assigns a lower reputation (e.g., Trustworthy or Low Risk) to that specific domain, overriding the automated score — reputation filtering supports both automated and manual reputation management The administrator adds the domain to a URL category exclusion list, which removes it from reputation scoring permanently

Question 6 of 6

Fifty employees in a corporate office all regularly access the same popular news website during working hours. After a forward proxy with caching is deployed, the IT team notices that external bandwidth consumption for that site drops by 95%. What proxy feature is responsible?

Access control — the proxy restricted which users are permitted to access the news site URL filtering — the proxy is blocking most requests to the news site based on category policy Caching — the proxy stores the news site's content locally after the first request; subsequent requests are served from the local cache without going to the internet Content scanning — the proxy is inspecting the news site's response for malware, which takes time and reduces effective bandwidth

Matching

Match each description to the correct web filtering technology.

1. Filtering that installs client software on user devices and enforces organizational web policy locally, keeping users protected on any network worldwide without requiring a VPN

2. A centralized internal proxy that routes and controls all outbound employee internet traffic; users on the internal network send requests to it and it fetches pages on their behalf

3. Evaluates websites on a five-level risk scale (Trustworthy → High Risk) using automated crawling and manual overrides; blocks high-risk sites before users interact with malicious content

4. Prevents connections to malicious domains by returning no IP address during name resolution; effective against phishing sites, malware C2 callbacks, and all DNS-dependent application traffic

1. 2. 3. 4.

A. Agent-Based Filtering

B. Forward Proxy

C. Reputation-Based Filtering

D. DNS Filtering

Web Filtering — Quiz

Matching