nerdexam
Cisco

300-710 · Question #107

There is an increased amount of traffic on the network and for compliance reasons, management needs visibility into the encrypted traffic. What is a result of enabling TLS'SSL decryption to allow…

The correct answer is A. It prompts the need for a corporate managed certificate. Enabling TLS/SSL decryption provides visibility into encrypted traffic but necessitates a corporate-managed certificate for client trust, as the firewall acts as an intermediary.

Deployment

Question

There is an increased amount of traffic on the network and for compliance reasons, management needs visibility into the encrypted traffic. What is a result of enabling TLS'SSL decryption to allow this visibility?

Options

  • AIt prompts the need for a corporate managed certificate
  • BIt has minimal performance impact
  • CIt is not subject to any Privacy regulations
  • DIt will fail if certificate pinning is not enforced

How the community answered

(26 responses)
  • A
    85% (22)
  • B
    8% (2)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Enabling TLS/SSL decryption provides visibility into encrypted traffic but necessitates a corporate-managed certificate for client trust, as the firewall acts as an intermediary.

AIt prompts the need for a corporate managed certificateCorrect

TLS/SSL decryption involves the firewall acting as a Man-in-the-Middle, requiring it to present a certificate to the client for the re-encrypted connection. For clients to trust these dynamically generated certificates, the corporate Certificate Authority's root certificate must be installed on client devices.

BIt has minimal performance impact

TLS/SSL decryption is a computationally intensive process that typically has a significant performance impact on security devices.

CIt is not subject to any Privacy regulations

Decrypting user traffic has substantial privacy implications and is heavily subject to various privacy regulations.

DIt will fail if certificate pinning is not enforced

Certificate pinning, when enforced by an application, will cause SSL decryption to fail because the application expects a specific certificate, not one issued by an intermediary firewall.

Concept tested: TLS/SSL decryption requirements and implications

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/ssl-decryption-policy.html

Topics

#TLS/SSL Decryption#Certificate Management#Corporate CA#Network Visibility

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-710 Practice