Palo_Alto_Networks
PSE-PLATFORM · Question #356
Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)
The correct answer is A. Create a no-decrypt Decryption Policy rule. D. Create a Security Policy rule with vulnerability Security Profile attached. Explanation/Reference:
Decryption and Certificate Management
Question
Which two actions would be part of an automatic solution that would block sites with untrusted certificates without enabling SSL Forward Proxy? (Choose two.)
Options
- ACreate a no-decrypt Decryption Policy rule.
- BConfigure an EDL to pull IP addresses of known sites resolved from a CRL.
- CCreate a Dynamic Address Group for untrusted sites
- DCreate a Security Policy rule with vulnerability Security Profile attached.
- EEnable the "Block sessions with untrusted issuers" setting.
How the community answered
(18 responses)- A67% (12)
- B22% (4)
- C6% (1)
- E6% (1)
Explanation
Explanation/Reference:
Topics
#SSL decryption#untrusted certificates#no-decrypt policy#blocking without forward proxy
Community Discussion
No community discussion yet for this question.