PSE-PLATFORM · Question #281
An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing. The…
The correct answer is D. Create a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule. Option D is correct because encrypted BitTorrent uses cipher suites that the firewall's SSL proxy cannot support. Without a Decryption Profile enforcing a block on unsupported ciphers, the firewall adds the server to its SSL exclude cache after the failed first-connection…
Question
An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing. The administrator generates three encrypted BitTorrent connections and checks the Traffic logs. There are three entries. The first entry shows traffic dropped as application Unknown. The next two entries show traffic allowed as application SSL. Which action will stop the second and subsequent encrypted BitTorrent connections from being allowed as SSL?
Options
- ACreate a decryption rule matching the encrypted BitTorrent traffic with action "No- Decrypt," and place the rule at the top of the Decryption policy.
- BCreate a Security policy rule that matches application "encrypted BitTorrent" and place the rule at the top of the Security policy.
- CDisable the exclude cache option for the firewall.
- DCreate a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule.
How the community answered
(44 responses)- A5% (2)
- B14% (6)
- C23% (10)
- D59% (26)
Explanation
Option D is correct because encrypted BitTorrent uses cipher suites that the firewall's SSL proxy cannot support. Without a Decryption Profile enforcing a block on unsupported ciphers, the firewall adds the server to its SSL exclude cache after the failed first-connection attempt - causing subsequent connections to bypass decryption entirely and be misidentified as generic "SSL," which the Security policy permits. Attaching a Decryption Profile with "block sessions with unsupported cipher suites" closes this gap by explicitly dropping those connections at the decryption stage before they ever reach the Security policy.
Why the distractors fail:
- A (No-Decrypt rule): Bypassing decryption doesn't block the traffic - the connection still passes and App-ID labels it "SSL," which your policy already allows. You need to block, not exempt.
- B (Security policy rule for "encrypted BitTorrent"): App-ID never identifies these connections as "encrypted BitTorrent" because decryption is being bypassed via the exclude cache - so the rule never matches. You can't block an application that isn't being identified as that application.
- C (Disable exclude cache): Disabling the cache forces re-evaluation on every connection, but without the Decryption Profile's explicit block instruction, the firewall still has no directive to drop traffic it can't decrypt - it defaults to passing it as SSL.
Memory tip: When traffic slips past your decryption rule disguised as SSL, think "Profile Plugs the Gap" - the Decryption Profile is the enforcement layer within the decryption rule that tells the firewall what to do when decryption fails, not just whether to attempt it.
Topics
Community Discussion
No community discussion yet for this question.