Decryption and SSL Inspection practice questions

Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.

Why wrong: Disabling globally would prevent decryption of all traffic, including the financial domains if not correctly handled, and the approach is not typical.

Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.

Why wrong: Uploading server certificates is not required for no-decrypt; the decryption profile does not have a 'no-decrypt' setting per domain.

Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.

Why wrong: 'decrypt' is not a valid action; the correct action is 'ssl-decrypt'. Also, excluding certificates is not the intended method for skipping decryption.

SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.

Why wrong: It can be applied to other ports as well, though 443 is default.

An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.

Why wrong: The certificate is configured in the Decryption Profile, but the 'ssl-decrypt' action does not require it; the profile must have a certificate for forward proxy, but it's not the action that requires it.

The forward trust certificate has expired or is not trusted by the clients in Branch Office A.

Why wrong: Certificate expiration or trust issues would affect all users, not just Branch Office A, and would typically result in certificate warnings, not handshake failures.

The decryption profile for Branch Office A is configured with an incorrect cipher suite that is not supported by the external websites.

Why wrong: Incorrect cipher suites would cause different errors, and the profile is identical to working branches.

The decryption policy rule for Branch Office A is missing the 'ssl-decrypt' action.

Why wrong: The policy is identical to others that work, so this is unlikely.

Configure the SSL/TLS Service Profile to bypass decryption for the domain.

Why wrong: The SSL/TLS Service Profile is used for inbound decryption and proxy settings, not for policy exclusion.

Configure a Decryption Profile to exclude the domain.

Why wrong: Decryption Profiles control cipher settings and certificate validation, not policy exclusion.

Enable certificate revocation checking for the decryption zone.

Why wrong: Certificate revocation checking is unrelated to excluding traffic from decryption.

Decryption is applied globally to all traffic; selective decryption is not possible.

Why wrong: Decryption policy allows selective decryption based on multiple criteria.

The firewall can decrypt all TLS sessions regardless of client certificate authentication.

Why wrong: Sessions with client certificate authentication cannot be decrypted unless the client certificate is imported on the firewall.

Traffic using Server Name Indication (SNI) in TLS must be decrypted at the firewall or it will be dropped.

Why wrong: SNI is used for routing but not required for decryption; traffic without SNI can still be decrypted.

Configure decryption settings per interface to distribute load.

Why wrong: Decryption settings are global, not per-interface.

Disable SSL decryption entirely to avoid performance issues.

Why wrong: Sacrifices visibility into encrypted threats.

Enable decryption on all traffic to ensure complete visibility.

Why wrong: This increases performance impact without justification.

The decryption certificate has expired.

Why wrong: Expiration would cause errors, but the scenario implies it's properly installed, so likely not expired.

The decryption certificate is not renewed automatically.

Why wrong: Automatic renewal is not a standard feature; manual intervention is needed.

The decryption certificate is self-signed.

Why wrong: Self-signed certificates can be used if the root CA is trusted, but that is not the typical issue.

The firewall must present the server's public certificate to clients.

Why wrong: The firewall presents its own certificate in inbound scenarios.

The firewall must have a trusted CA certificate installed.

Why wrong: That is for forward proxy decryption.

The firewall must be configured to only accept TLS 1.2 or higher.

Why wrong: Not a critical requirement; versions are negotiated.

Mask the original source IP address for privacy.

Why wrong: Not related to decryption.

Allow only inbound SSL traffic to be inspected.

Why wrong: Decryption works for both directions.

Improve network performance by reducing encryption overhead.

Why wrong: Decryption actually adds overhead.

Add all financial and healthcare sites to a custom URL list and exclude them.

Why wrong: Impractical to list all sites; categories are dynamic.

Create a decrypt-all rule and then add exceptions for financial and healthcare categories.

Why wrong: Not efficient; exceptions could miss other compliance issues.

Use time-based rules to apply decryption only during business hours.

Why wrong: Time-based rules are not applicable for category-based exclusions.

The firewall does not support decryption of that traffic.

Why wrong: It does support decryption but cannot handle the cipher.

The decryption certificate is not trusted by the client.

Why wrong: Trust errors produce certificate warnings, not cipher errors.

The decryption rule is not matching the traffic.

Why wrong: Matching issues would show no decryption, not cipher errors.

The URL is not allowed in the decryption policy.

Why wrong: That would block the site, not cause partial loading.

The user's browser proxy settings are incorrect.

Why wrong: Decryption in forward proxy does not require manual proxy configuration.

The firewall's decryption is causing excessive latency.

Why wrong: Latency would cause slowness, not complete failure.

Use a self-signed certificate and manually install it on each client.

Why wrong: Not scalable for large enterprises.

Use a wildcard certificate from a public CA to simplify deployment.

Why wrong: Wildcard certificates are not recommended for decryption due to security concerns.

Use a certificate from a public CA that is already trusted by clients.

Why wrong: Firewall would need the private key, which is usually not available for public CAs.

Configure the DLP appliance to decrypt traffic itself.

Why wrong: DLP appliances typically receive decrypted traffic from the firewall.

Configure the firewall to re-encrypt traffic before sending to DLP.

Why wrong: DLP needs decrypted traffic for inspection.

Add a decryption policy on the firewall to exclude traffic to the DLP appliance.

Why wrong: That would bypass decryption for DLP traffic, not help.

The firewall detects that the session is already decrypted (e.g., by another device).

Why wrong: The firewall does not detect if traffic is already decrypted; it will attempt decryption.

The traffic matches a 'no-decrypt' rule in the decryption policy.

Why wrong: That is a policy-based bypass, not a condition; the question asks for conditions.

The decrypted data exceeds a certain size threshold.

Why wrong: Size does not cause bypass; the firewall will still decrypt.

Update the URL filtering database to ensure the site is categorized correctly.

Why wrong: Does not affect decryption; that affects policy matching.

Disable decryption globally to see if the sites become accessible.

Why wrong: This is a disruptive workaround, not a troubleshooting step.

Traffic to social media websites.

Why wrong: Typically not a compliance concern.

Traffic between internal data center servers.

Why wrong: Internal traffic is often decrypted to detect lateral movement.

Traffic to external email services (e.g., Gmail).

Why wrong: Often decrypted for security.

The firewall is overloaded and cannot handle more decryption sessions.

Why wrong: Active sessions are low, so not overloaded.

The decryption certificate is not trusted by clients.

Why wrong: That would cause certificate validation failures, which are fewer.

There is a network connectivity issue between firewall and servers.

Why wrong: Connectivity issues would cause handshake failures, which are minimal.