Which statement about HTTPS decryption on the WSA is true?

Question

Options

• ADecrypted HTTPS traffic is sent unencrypted across the enterprise intranet.
• BObject size can be used to determine whether the HTTPS traffic is to be decrypted.
• CIf WBRS is enabled, it can be used to determine whether the HTTPS traffic is to be decrypted
• DIf enabled, all HTTPS traffic must be decrypted.

• A
  4% (2)
• B
  7% (3)
• C
  76% (34)
• D
  13% (6)

Explanation

WBRS (Web-Based Reputation Score) is one of the valid policy conditions the Cisco WSA evaluates when deciding whether to decrypt HTTPS traffic - high-trust sites can be passed through, while low-reputation sites can be flagged for decryption and inspection. This makes C correct.

• A is wrong because the WSA acts as a man-in-the-middle proxy: it re-encrypts traffic toward the client using its own certificate, so decrypted content never traverses the intranet in plaintext.
• B is wrong because decryption policy decisions are driven by criteria like URL category, WBRS, user identity, and time of day - not object/file size (which applies to access policies, not decryption policies).
• D is wrong because HTTPS decryption is policy-based and selective; you can configure rules to pass through, drop, or decrypt traffic depending on conditions - it is never an all-or-nothing requirement.

Memory tip: Think "reputation decides decryption" - WBRS gives each site a trust score, and the WSA uses that score to make the decrypt/pass-through call, just like a bouncer checking IDs only for suspicious guests.

No community discussion yet for this question.