Q9Content Security
How does a Cisco Secure Web Appliance integrated with LDAP handle the permissions of a currently logged-in Active Directory group member when the Active Directory administrator changes the user's group permissions during the session?
← → navigate · a answer
Community votes
Discussion · 5
D 4
Selected Answer: D
https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa_14-0/User-Guide/b_WSA_UserGuide_14_0/b_WSA_UserGuide_11_7_chapter_010110.html
https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-5/user_guide/b_WSA_UserGuide_11_5/b_WSA_UserGuide_chapter_01001.html#con_1338404
Relevant section: external authentication cache timeout
Default timeout is 0 second - WSA does not contact the LDAP server to reauthenticate the current session.
B 3
Selected Answer: B
Answer is B: If WSA is set up for real-time LDAP lookups, it will re-check LDAP permissions on every request, applying the updated group policies right away. (Dynamic Authorization Updates)
HOWEVER - If LDAP session caching is enabled, permission changes may not take effect until the session expires or the cache is manually refreshed (which makes D the correct answer)
No information about session cache - so assuming not enabled.
2
Answer is correcto, the integration with LDAP validates the credentials at the session's beginning and you need to end the session or re-authenticate to request new credentials.
D 2
Selected Answer: D
the Cisco Web Security Appliance (WSA) does not support real-time LDAP updates; instead, it uses a "basic authentication scheme" where it checks the LDAP server when the user logs in to verify credentials or membership, but it does not watch the LDAP directory for changes in real-time.
1
it is D
the Cisco Web Security Appliance (WSA) does not support real-time LDAP updates; instead, it uses a "basic authentication scheme" where it checks the LDAP server when the user logs in to verify credentials or membership, but it does not watch the LDAP directory for changes in real-time.