Which two SSH Proxy decryption profile configurations will reduce network attack surface? (Choose two.)

The correct answer is C. Block sessions on certificate errors. D. Block sessions with unsupported versions. Reducing attack surface means eliminating opportunities for attackers to exploit weak or invalid configurations. Blocking sessions on certificate errors (C) prevents connections where the server certificate cannot be validated - a condition that may indicate a man-in-the-middle…

Threat Prevention

Question

Options

AAllow sessions if resources not available.
BAllow sessions with unsupported versions.
CBlock sessions on certificate errors.
DBlock sessions with unsupported versions.

How the community answered

(22 responses)

B
5% (1)
C
95% (21)

Explanation

Reducing attack surface means eliminating opportunities for attackers to exploit weak or invalid configurations. Blocking sessions on certificate errors (C) prevents connections where the server certificate cannot be validated - a condition that may indicate a man-in-the-middle attack or a misconfigured/compromised endpoint. Blocking sessions with unsupported versions (D) prevents the use of outdated SSH protocol versions (e.g., SSHv1) that contain known cryptographic weaknesses and vulnerabilities. Allowing sessions when resources are not available (A) introduces a fail-open condition, which expands the attack surface by letting uninspected traffic through. Allowing sessions with unsupported versions (B) directly contradicts the goal of reducing attack surface by permitting insecure protocol versions.

Topics

#SSH Decryption#Attack Surface Reduction#Security Best Practices#Threat Prevention

Community Discussion

No community discussion yet for this question.

Full NETSEC-GENERALIST Practice