Which log file can be used to identify SSL decryption failures?

Question

Options

• ATraffic
• BACC
• CConfiguration
• DThreats

• A
  93% (28)
• B
  3% (1)
• C
  3% (1)

Explanation

Traffic logs record all network traffic passing through the firewall, including SSL/TLS sessions, making them the right place to investigate SSL decryption failures - you'll find entries showing handshake errors, certificate issues, and decryption policy mismatches there.

ACC (Application Command Center) is a graphical dashboard for visualizing trends and statistics, not a raw log for troubleshooting specific failures. Configuration logs capture administrative changes to the device (policy edits, admin logins), not traffic-level events. Threat logs only record entries when a security profile (antivirus, vulnerability protection, etc.) triggers on traffic - an SSL decryption failure won't generate a threat log entry by itself.

Memory tip: Think "Traffic = everything that flows." If a packet hit the wire (or failed to be inspected), check the Traffic log first. SSL decryption is a traffic-processing step, so its failures live in the Traffic log.

No community discussion yet for this question.