BCCPP Blue Coat Certified Proxysg Professional Practice Questions

Early intercept is a crucial feature for transparent deployments. When a connection arrives at a listener with this feature enabled, the ProxySG intercepts it immediately at the TCP level. It then uses protocol detection to determine the nature of the traffic (e.g., HTTP, SSL, FTP). Based on the detected protocol, it hands the connection off to the appropriate internal proxy service for handling. This allows a single listener (e.g., on port 80) to correctly process multiple protocols without requiring the client to be explicitly configured for a specific proxy protocol.

This statement is false. The SGOS object store is a unified caching system. It does not segregate cached objects based on the protocol used to retrieve them. An object retrieved via HTTP can be served to a subsequent FTP request if the URL and object are identical. This unified approach maximizes caching efficiency by preventing redundant storage of the same object fetched via different protocols.

This solution addresses all requirements. Configuring as a reverse proxy with SSL termination achieves the SSL offload goal. A forwarding host group with health checks provides robust load balancing, taking servers out of rotation if they fail. The 'source-ip-hash' algorithm is a built-in method to provide session persistence by ensuring requests from the same client IP are always sent to the same OCS. Finally, aggressive caching of static content will significantly improve performance. This is the most comprehensive and best-practice approach among the options.

This CPL snippet correctly implements the logic. It creates a rule that matches on three conditions simultaneously: the request's category is 'Social Networking', the URL domain is NOT linkedin.com, and the HTTP method is POST. Only if all three conditions are true will the DENY action be triggered. This effectively blocks posts to all social networking sites while allowing them for the specified exception.

The correct approach is to create a new, more specific Web Access Layer that is evaluated before the general, global logging layer. By placing the new layer above the existing one, its rules are processed first. A rule matching the specific financial partner APIs can then apply the detailed logging action. Since policy evaluation stops at the first match within a layer for a given action, no further rules are needed in this new layer for other traffic; the request will simply 'fall through' to the next layer (the global one) which handles the logging for all other traffic.

Kerberos is highly sensitive to time synchronization. A time skew of more than five minutes (by default) between the client (in this case, the ProxySG acting on behalf of the user) and the KDC will cause authentication to fail. The KDC error KRB5KDC_ERR_PREAUTH_REQUIRED can be misleading, but it is a common symptom of time synchronization problems, as the timestamp in the authenticator of the AS-REQ packet will be considered invalid by the KDC. Since users can authenticate when bypassing the proxy, the issue lies with the proxy's interaction with the KDC, making time skew the most probable cause.

The cache.ttl_if_fresher_than(seconds) directive provides an excellent balance for frequently updated content. It instructs the ProxySG to serve the cached object if it is fresher than the specified time (e.g., 300 seconds), but to revalidate it with the OCS if it's older. This avoids constant revalidation for very fresh content (reducing OCS load) while ensuring that content that is likely stale gets checked, thus providing users with up-to-date information without the overhead of checking every single time (always) or relying on potentially long minimum TTLs.

This statement is true. During SSL interception, the ProxySG acts as a man-in-the-middle. It establishes a secure session with the origin server, inspects its certificate, and then creates a new certificate on-the-fly. This new certificate emulates the identity of the origin server by copying key fields like the Common Name (CN) and Subject Alternative Name (SAN). This emulated certificate is then signed by the CA certificate installed on the ProxySG and presented to the client browser to establish the client-side secure session.