FCSS_EFW_AD-7.4 · Question #8
An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic. Which SSL…
The correct answer is D. Enable SSL certificate inspection mode to perform basic checks without decrypting traffic. To minimize CPU and RAM usage while still enforcing security features like web filtering and application control, SSL certificate inspection mode is the best choice. SSL certificate inspection allows FortiGate to inspect only the SSL/TLS handshake, including the Server Name…
Question
An administrator must minimize CPU and RAM use on a FortiGate firewall while also enabling essential security features, such as web filtering and application control for HTTPS traffic. Which SSL inspection setting helps reduce system load while also enabling security features, such as web filtering and application control for encrypted HTTPS traffic?
Options
- AUse full SSL inspection to thoroughly inspect encrypted payloads.
- BDisable SSL inspection entirely to conserve resources.
- CConfigure SSL inspection to handle HTTPS traffic efficiently.
- DEnable SSL certificate inspection mode to perform basic checks without decrypting traffic.
How the community answered
(34 responses)- A15% (5)
- B6% (2)
- C3% (1)
- D76% (26)
Explanation
To minimize CPU and RAM usage while still enforcing security features like web filtering and application control, SSL certificate inspection mode is the best choice. SSL certificate inspection allows FortiGate to inspect only the SSL/TLS handshake, including the Server Name Indication (SNI) and certificate details, without decrypting the full encrypted payload. This enables features like web filtering and application control because FortiGate can determine the destination website or application based on SNI and certificate information. It significantly reduces system load compared to full SSL inspection, which requires full decryption and re-encryption of traffic.
Topics
Community Discussion
No community discussion yet for this question.