PCNSE · Question #378
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
The correct answer is C. the web server requires mutual authentication D. the website matches a sensitive category. The 'No Decrypt' action is used to intentionally skip SSL inspection for certain traffic. (C) If a web server requires mutual TLS authentication (mTLS), the client must present its certificate directly to the server. When the firewall acts as a forward proxy and decrypts…
Question
What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
Options
- Athe website matches a category that is not allowed for most users
- Bthe website matches a high-risk category
- Cthe web server requires mutual authentication
- Dthe website matches a sensitive category
How the community answered
(50 responses)- A8% (4)
- B4% (2)
- C88% (44)
Explanation
The 'No Decrypt' action is used to intentionally skip SSL inspection for certain traffic. (C) If a web server requires mutual TLS authentication (mTLS), the client must present its certificate directly to the server. When the firewall acts as a forward proxy and decrypts traffic, it breaks this mutual authentication process, so the traffic must be excluded. (D) Websites in sensitive categories - such as financial institutions, healthcare, or legal services - contain private user data. Decrypting this traffic may violate privacy regulations or organizational policies, making exclusion appropriate. (A) is incorrect because non-allowed categories should be blocked, not excluded from decryption. (B) is incorrect because high-risk sites are prime candidates FOR decryption and inspection, not exclusion.
Topics
Community Discussion
No community discussion yet for this question.