hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A network administrator is configuring Cisco ASA…
A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?
⚠ Common exam trap
Cisco often tests the misconception that installing a trusted root CA on clients is sufficient to handle all SSL inspection scenarios, but the trap here is that certificate pinning bypasses CA trust entirely by comparing against a hardcoded certificate or public key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning
Certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure SSL inspection to bypass all traffic to avoid any issues
Why it's wrong here
This would defeat the purpose of SSL inspection.
- ✗
Install a custom root CA on all clients and configure the ASA to use that CA
Why it's wrong here
This is a general requirement for SSL inspection, but it does not address certificate pinning issues.
- ✓
Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning
Why this is correct
Excluding pinned applications prevents the ASA from interfering with certificate validation.
- ✗
Use a decryption policy that decrypts the traffic but does not re-encrypt
Why it's wrong here
SSL inspection inherently requires re-encryption; you cannot leave traffic decrypted.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.