A network administrator wants to deploy SSL Forward Proxy decryption. What two attributes should a forward trust certificate have? (Choose two.)

Question

Options

• AA certificate authority (CA) certificate
• BA private key
• CA server certificate
• DA subject alternative name

• A
  89% (16)
• C
  6% (1)
• D
  6% (1)

Explanation

For SSL Forward Proxy decryption, the firewall acts as a man-in-the-middle by intercepting encrypted traffic and re-signing it on behalf of trusted sites - to do this, the forward trust certificate must be a CA certificate (A) so it can sign newly generated certificates for intercepted connections, and it must have a private key (B) so the firewall can cryptographically sign those certificates.

Why the distractors are wrong:

• C (server certificate): A server certificate identifies a specific server endpoint; it cannot issue new certificates, making it useless for re-signing intercepted traffic.
• D (subject alternative name): SANs are fields within certificates that list valid hostnames - they are attributes a certificate can contain, not requirements for a forward trust certificate's function.

Memory tip: Think of the firewall as a "mini CA" - just like any Certificate Authority, it needs two things: the CA flag (so clients trust its signed certs) and a private key (so it can actually do the signing). No key = can't sign; no CA flag = clients won't trust what it signs.

No community discussion yet for this question.