Which command option is used to configure a Secure Web Gateway content switching vserver with explicit-auth-vs?

• A. Add cs vserver swgVS PROXY 192.168.10.1 80 -Authn401 on -authnVsName explicit-auth-vs
• B. Add cs vserver swgVS PROXY ** -Authn401 on -authnVsName explicit-auth-vs
• C. Add cs vserver swgVS PROXY 192.168.10.1 -Authn401 on -authnVsName transparent-auth-vs
• D. Add cs vserver swgVS PROXY * 21 -Authn401 on -authnVsName transparent-auth-vs

Answer: (B)

In Secure Web Gateway content switching, you enable an explicit authentication flow by tying the CSV to an authentication vserver and turning on the 401 challenge. The CSV service type must be PROXY, and you tell it which authentication vserver to use with -authnVsName, pointing to the explicit-auth-vs in this case. Turning on -Authn401 ensures that when a user without valid credentials hits the SWG, the system prompts for authentication rather than passing traffic transparently. Binding to a wildcard address allows the vserver to listen on all interfaces, so SWG traffic can be intercepted regardless of which interface clients use.

Using the explicit-auth-vs name with 401 on is what enables the explicit authentication flow required for SWG, while choosing a different authentication vserver name (like transparent-auth-vs) would implement a different, non-explicit behavior. The wildcard binding option is the common approach for a global SWG CSV that needs to service multiple interfaces, which is why the command that uses the explicit-auth-vs with a wildcard binding is the correct one.