300-725 · Question #14
Which two configuration options can be configured when invalid certificates are processed with the HTTPS proxy on WSA enabled? (Choose two.)
The correct answer is B. monitor C. drop. When the Cisco WSA HTTPS proxy encounters invalid server certificates (e.g., expired, self-signed, mismatched hostname, or unverifiable chain), the two configurable actions are: (1) Monitor - allow the connection to proceed and log the certificate issue for auditing without…
Question
Which two configuration options can be configured when invalid certificates are processed with the HTTPS proxy on WSA enabled? (Choose two.)
Options
- Aallow
- Bmonitor
- Cdrop
- Dblock
- Eredirect
How the community answered
(47 responses)- A2% (1)
- B87% (41)
- D6% (3)
- E4% (2)
Explanation
When the Cisco WSA HTTPS proxy encounters invalid server certificates (e.g., expired, self-signed, mismatched hostname, or unverifiable chain), the two configurable actions are: (1) Monitor - allow the connection to proceed and log the certificate issue for auditing without alerting the user; and (2) Drop - silently terminate the TCP connection without sending the user an error page or notification. These options are distinct from 'Block,' which sends an end-user notification page, and 'Allow,' which is not a separate action for invalid cert handling. 'Redirect' is not an available action for invalid certificate handling in the WSA HTTPS proxy configuration.
Topics
Community Discussion
No community discussion yet for this question.