An engineer must configure a new SSL decryption deployment. Which profile or certificate is required before any traffic that matches an SSL decryption rule is decrypted?

Question

Options

• AThere must be a certificate with both the Forward Trust option and Forward Untrust option
• BA Decryption profile must be attached to the Decryption policy that the traffic matches
• CA Decryption profile must be attached to the Security policy that the traffic matches
• DThere must be a certificate with only the Forward Trust option selected

• A
  2% (1)
• B
  90% (37)
• C
  2% (1)
• D
  5% (2)

Explanation

For SSL decryption to occur on traffic matching a Decryption rule, a Decryption profile must be explicitly attached to that Decryption policy. The Decryption profile defines the SSL/TLS protocol enforcement settings, certificate verification behavior, and session-level actions (e.g., blocking sessions with expired or untrusted certificates, enforcing minimum TLS versions). Without a Decryption profile attached, the policy does not have the necessary inspection parameters to actively decrypt and evaluate traffic. While Forward Trust and Forward Untrust CA certificates are also required for SSL Forward Proxy, the exam identifies the Decryption profile on the Decryption policy as the required element. Note: Decryption profiles attach to Decryption policies, not Security policies, making choice C incorrect.

No community discussion yet for this question.