CAS-003 · Question #196
The security administrator of a large enterprise is tasked with installing and configuring a solution that will allow the company to inspect HTTPS traffic for signs of hidden malware and to detect…
The correct answer is A. Install a self-signed Root CA certificate on the proxy server. E. Implement policy-based routing on a router between the hosts and the Internet. F. The proxy certificate must be installed on all users' browsers. SSL/TLS inspection (SSL interception) works by having the proxy act as a trusted man-in-the-middle: it terminates the client's HTTPS connection, decrypts the traffic, inspects it, re-encrypts it, and forwards it to the destination. To prevent browser certificate warnings: (A) A…
Question
The security administrator of a large enterprise is tasked with installing and configuring a solution that will allow the company to inspect HTTPS traffic for signs of hidden malware and to detect data exfiltration over encrypted channels. After installing a transparent proxy server, the administrator is ready to configure the HTTPS traffic inspection engine and related network equipment. Which of the following should the security administrator implement as part of the network and proxy design to ensure the browser will not display any certificate errors when browsing HTTPS sites? (Select THREE).
Options
- AInstall a self-signed Root CA certificate on the proxy server.
- BThe proxy configuration of all users' browsers must point to the proxy IP.
- CTCP port 443 requests must be redirected to TCP port 80 on the web server.
- DAll users' personal certificates' public key must be installed on the proxy.
- EImplement policy-based routing on a router between the hosts and the Internet.
- FThe proxy certificate must be installed on all users' browsers.
How the community answered
(26 responses)- A58% (15)
- B27% (7)
- C12% (3)
- D4% (1)
Explanation
SSL/TLS inspection (SSL interception) works by having the proxy act as a trusted man-in-the-middle: it terminates the client's HTTPS connection, decrypts the traffic, inspects it, re-encrypts it, and forwards it to the destination. To prevent browser certificate warnings: (A) A self-signed Root CA must be installed on the proxy so it can dynamically issue trusted certificates for each destination site; (E) Policy-based routing on a router between hosts and the Internet is needed for a transparent proxy to redirect traffic to the proxy without requiring manual browser proxy settings; (F) The proxy's Root CA certificate must be installed (trusted) in all users' browsers so that certificates the proxy generates on the fly are accepted without errors. Option B applies to explicit (non-transparent) proxy deployments. Option C would break HTTPS by downgrading to HTTP. Option D is irrelevant-user personal certificates are for client authentication, not server trust.
Topics
Community Discussion
No community discussion yet for this question.