CND Practice Question: Network Security Controls Protocols And Devices

A company is implementing a next-generation firewall (NGFW) and wants to inspect encrypted HTTPS traffic traversing the network without triggering browser certificate warning errors on corporate-managed endpoints. Which deployment method achieves this?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deploy an internal Enterprise CA-signed forward proxy decryption certificate to all managed endpoints' trusted root stores.

To inspect HTTPS traffic without causing SSL/TLS warnings, the NGFW must perform SSL/TLS decryption (Forward Proxy) and be configured to issue dynamically generated certificates signed by the organization's internal Enterprise Root Certificate Authority, which is pre-installed on all corporate endpoints.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disable certificate validation checks on all user web browsers via group policy.
Why it's wrong here
Disabling browser certificate validation completely destroys web browsing security and exposes users to active man-in-the-middle attacks.
✗
Configure the firewall in passive tap mode using asymmetric decryption keys derived from the public web server's private key.
Why it's wrong here
Passive decryption using server private keys is deprecated in modern TLS 1.3 due to Perfect Forward Secrecy; forward proxy re-signing is required.
✗
Install a self-signed certificate generated by the firewall onto the firewall itself.
Why it's wrong here
Installing the certificate only on the firewall does not resolve client browser trust issues; the certificate must be trusted by the endpoints.
✓
Deploy an internal Enterprise CA-signed forward proxy decryption certificate to all managed endpoints' trusted root stores.
Why this is correct
Endpoints must trust the issuing CA of the firewall's re-signing certificate to prevent certificate warning errors during HTTPS inspection.

About these practice questions

One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Start a scored session and see where you stand.

Start practice session

Scored practice sessions

Short scored sets — answer, get feedback, read the explanation, move on.

CND Practice Questions 2 — 50 Questions→CND Practice Exam 2 — 20 Questions→

Study by exam domain

Drill one exam section at a time instead of jumping between unrelated topics.

Network Security Controls Protocols And Devices Endpoint Protection Network Defense Management

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Topic-level practice

One concept per page — questions, worked explanations, and a short concept guide.

Network Security Controls Protocols And Devices practice questions CND scenario practice questions Network Perimeter Protection practice questions

Continue studying

CND practice test All CND questions Study guide

This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.