hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A financial institution uses Cisco Firepower…
A financial institution uses Cisco Firepower Threat Defense (FTD) for intrusion prevention and SSL decryption. The security team recently enabled SSL decryption on the FTD to inspect encrypted traffic. After the change, some internal applications that use client certificates for authentication stopped working. The FMC shows that SSL decryption is configured to inspect traffic to specific destination IPs. The applications are using a custom port (TCP 8443) for HTTPS. The administrator has already added the custom port to the SSL decryption policy. What is the most likely reason the applications are failing?
⚠ Common exam trap
Cisco often tests the misconception that adding the custom port to the SSL decryption policy is sufficient, when the real issue is the FTD's inability to re-encrypt with the original client certificate during mutual TLS authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The applications are using client certificates, and the FTD is unable to re-encrypt with the original client certificate.
When FTD performs SSL decryption, it acts as a man-in-the-middle: it terminates the client's SSL connection, inspects the plaintext, and then initiates a new SSL connection to the server. If the client application presents a client certificate for authentication, the FTD cannot re-encrypt the new connection with that same client certificate because it does not have access to the client's private key. The server then rejects the re-encrypted connection, causing the application to fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The applications are using client certificates, and the FTD is unable to re-encrypt with the original client certificate.
Why this is correct
SSL decryption terminates the original SSL session, so client certificates are lost and cannot be passed to the server.
- ✗
The applications are using IPsec, not SSL.
Why it's wrong here
If the applications were using IPsec, SSL decryption would not affect them.
- ✗
The internal CA certificate is not trusted by the FTD.
Why it's wrong here
Even if the CA certificate is trusted, client certificate authentication is still broken because FTD cannot re-encrypt with the original client certificate.
- ✗
The FTD is not configured to inspect traffic on port 8443.
Why it's wrong here
The administrator added the custom port, so inspection should be occurring.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.