350-701 Network Security Practice Question
A Cisco FTD device is deployed in inline mode and configured with an SSL policy to decrypt traffic. The policy uses 'Decrypt - Known Key' for traffic to an internal server. What is required for this decryption to work?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FTD must have the server's private key imported.
'Decrypt - Known Key' requires the server's private key to be imported into the FTD so it can decrypt the traffic by impersonating the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FTD must generate a new certificate for each session.
Why it's wrong here
Not required; the FTD uses the server's certificate.
- ✗
The server's certificate must be signed by a public CA.
Why it's wrong here
The certificate can be self-signed; what matters is having the private key.
- ✓
The FTD must have the server's private key imported.
Why this is correct
Correct; the FTD needs the private key to decrypt traffic encrypted with the server's public key.
- ✗
The client must trust the FTD's CA certificate.
Why it's wrong here
That is required for 'Decrypt - Resign', not 'Decrypt - Known Key'.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.