Drag and Drop Question Drag and drop the actions from the left into the correct order on the right in which they occur as an HTTPS session passes through the Cisco WSA. Answer:

Question

Exhibit

Answer Area

Explanation

The question requires ordering the steps of an HTTPS session through a Cisco WSA acting as an intercepting proxy, which involves a multi-stage SSL/TLS handshake.

Approach. The correct interaction is to drag the actions into the following sequence in the 'Answer Area':

1. Step 1: Client sends a hello message to Cisco WSA. Reasoning: This is always the initiation of the SSL/TLS handshake from the client side. The client wants to establish a secure connection and sends its 'Client Hello' message to the proxy.

2. Step 2: Server replies with server certificate to Cisco WSA. Reasoning: Upon receiving the client hello, the Cisco WSA (acting as a client) initiates its own SSL/TLS handshake with the actual destination server. The server responds with its 'Server Hello' and its server certificate to the WSA.

3. Step 3: Cisco WSA replies with a proxied certificate of the destination server to the client. Reasoning: The WSA, functioning as an intercepting proxy, now generates and signs a new certificate for the client, mimicking the original server's certificate. This 'proxied certificate' is then sent to the client as part of the WSA's 'Server Hello' to the client.

4. Step 4: Client sends the session key, which is encrypted by using public key of the server certificate. Reasoning: After verifying the (proxied) certificate received from the WSA, the client generates a pre-master secret (session key). It encrypts this key using the public key from the certificate it just received (which is the WSA's proxied certificate's public key) and sends it back to the WSA.

5. Step 5: Encryption data channel is established. Reasoning: Once both the client-WSA and WSA-server connections have successfully exchanged and agreed upon the session keys, the symmetric encryption data channels are established. Data can now flow securely between the client and WSA, and between the WSA and the destination server, with the WSA decrypting and re-encrypting traffic in between.

Common mistakes.

• common_mistake. A common mistake is confusing the order of the two distinct SSL/TLS handshakes involved: the client-WSA handshake and the WSA-server handshake. Forgetting that the WSA acts as an intercepting proxy that presents its own proxied certificate to the client, rather than forwarding the original server's certificate directly, can lead to incorrect ordering. For example, placing 'Cisco WSA replies with a proxied certificate' before 'Server replies with server certificate' would be incorrect because the WSA needs to receive the original server's certificate first to generate its own proxied version. Also, placing 'Encryption data channel is established' too early, before the key exchange, is wrong because the data channel can only be secured once keys are successfully exchanged and verified.

Concept tested. SSL/TLS handshake process, specifically with an intercepting proxy (like Cisco WSA) performing a Man-in-the-Middle (MITM) decryption and re-encryption.

No community discussion yet for this question.