NGFW-ENGINEER · Question #73
A company is enabling SSL Forward Proxy to inspect encrypted traffic. A security engineer generates a new certificate on the firewall and flags it with the "Forward Trust" certificate property. What…
The correct answer is D. Install the public portion of the forward trust certificate into the trust store of all client machines. For SSL Forward Proxy decryption to work transparently, client devices must trust the firewall as a valid certificate authority, which requires installing the public portion of the forward trust certificate into the trusted root certificate store on all client machines to…
Question
A company is enabling SSL Forward Proxy to inspect encrypted traffic. A security engineer generates a new certificate on the firewall and flags it with the "Forward Trust" certificate property. What is the critical next step that must be performed for decryption to function correctly without causing security warnings for end users?
Options
- ASet the forward trust certificate as the SSL/TLS Service profile for the management interface.
- BCreate a Security policy rule that allows traffic from the certificate of the firewall to all the zones.
- CImport the private key of the forward trust certificate onto the domain controller.
- DInstall the public portion of the forward trust certificate into the trust store of all client machines.
How the community answered
(44 responses)- A2% (1)
- C5% (2)
- D93% (41)
Explanation
For SSL Forward Proxy decryption to work transparently, client devices must trust the firewall as a valid certificate authority, which requires installing the public portion of the forward trust certificate into the trusted root certificate store on all client machines to prevent browser and OS security warnings.
Topics
Community Discussion
No community discussion yet for this question.