easyMultiple ChoiceObjective-mapped
350-701 Practice Question: An administrator is configuring a Cisco ASA…
An administrator is configuring a Cisco ASA 5500-X to perform SSL inspection for outbound traffic. The users must be able to access HTTPS websites without certificate errors. Which configuration step is essential for the ASA to perform decryption?
⚠ Common exam trap
Cisco often tests the misconception that the ASA needs the server's private key (Option B) to decrypt traffic, when in fact the ASA performs a full man-in-the-middle proxy and only needs its own trusted CA certificate distributed to clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a trusted root CA certificate on the ASA and distribute it to all client machines.
For the ASA to perform SSL inspection (a man-in-the-middle proxy), it must generate a trusted root CA certificate that is installed as a trusted root on all client machines. This allows the ASA to dynamically sign the web server's certificate during the SSL handshake, so clients trust the re-encrypted traffic without certificate errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the ASA to use a self-signed certificate without distribution.
Why it's wrong here
Self-signed cert causes client certificate errors unless distributed to trust store.
- ✗
Import the web server's private key onto the ASA.
Why it's wrong here
ASA does not need server private keys; it generates dynamic certificates.
- ✗
Configure AAA authentication for SSL inspection.
Why it's wrong here
AAA is for access control, not for certificate trust.
- ✓
Generate a trusted root CA certificate on the ASA and distribute it to all client machines.
Why this is correct
Clients need to trust the ASA's certificate to avoid warnings.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.