nerdexam
Palo_Alto_Networks

NETSEC-PRO · Question #44

Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)

The correct answer is B. Incomplete certificate chains C. Certificate pinning. When implementing SSL Forward Proxy decryption for outbound traffic, two key challenges that must be evaluated are: Incomplete certificate chains: This occurs when the firewall cannot validate the entire certificate chain for a site, which may cause decryption failures. Certifica

Decryption and SSL/TLS Inspection

Question

Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)

Options

  • ARADIUS profile
  • BIncomplete certificate chains
  • CCertificate pinning
  • DSAML certificate

How the community answered

(26 responses)
  • A
    15% (4)
  • B
    77% (20)
  • D
    8% (2)

Explanation

When implementing SSL Forward Proxy decryption for outbound traffic, two key challenges that must be evaluated are: Incomplete certificate chains: This occurs when the firewall cannot validate the entire certificate chain for a site, which may cause decryption failures. Certificate pinning: Applications like banking apps may use certificate pinning to prevent MITM (man-in-the-middle) attacks, and these applications will break if SSL Forward Proxy is used. When decrypting outbound SSL traffic, you must consider incomplete certificate chains, which can cause decryption to fail if the firewall cannot validate the entire chain. Also, be aware of certificate pinning in applications that prevents decryption by rejecting forged certificates.

Topics

#SSL decryption#certificate pinning#certificate chains#traffic inspection

Community Discussion

No community discussion yet for this question.

Full NETSEC-PRO Practice