Which two tasks are required when a decryption policy is implemented on a Cisco WSA? (Choose two.)

Configuring invalid certificate handling is a best practice for security but is not a *required* task for the basic implementation of HTTPS decryption itself, though it's often done in conjunction.

For a Cisco WSA to decrypt HTTPS traffic, it must act as a man-in-the-middle proxy; this requires uploading a trusted root CA certificate (or an intermediate CA) and its private key to the WSA so it can dynamically sign the re-issued certificates presented to clients.

While enabling real-time revocation status checking (like OCSP/CRL) is important for security, it is a configuration for how the WSA *validates* server certificates, not a prerequisite for its own ability to decrypt traffic.

Enabling HTTPS attack protection is a security feature that *uses* decrypted traffic but is not a prerequisite for the decryption process itself.

Enabling the HTTPS proxy is a fundamental prerequisite for any HTTPS decryption policy on a Cisco WSA, as it allows the appliance to intercept and process encrypted web traffic.