Which decryption requirement ensures that inspection can be provided to all inbound traffic routed to internal application and database servers?

Question

Options

• AInstallation of certificates from the application server and database server on the NGFW and
• BInstallation of a trusted root CA certificate on the NGFW and configuration of an SSL Inbound
• CConfiguration of an SSL Inbound Decryption policy using one of the built-in certificates included in
• DConfiguration of an SSL Inbound Decryption policy without installing certificates

• A
  75% (12)
• B
  13% (2)
• C
  6% (1)
• D
  6% (1)

Explanation

Option A is correct because SSL Inbound Inspection requires the NGFW to terminate and decrypt incoming TLS sessions on behalf of internal servers - and to do that, it must possess the actual server certificates along with their private keys. Without the private keys, the firewall cannot perform the asymmetric decryption needed to read the session key and inspect the traffic.

Why the distractors fail:

• Option B (trusted root CA cert) describes the setup for SSL Forward Proxy (outbound inspection), where the NGFW generates certificates signed by a CA clients trust. For inbound traffic, a CA cert alone gives the firewall no ability to decrypt sessions destined for servers whose private keys it doesn't hold.
• Option C (built-in certificates) is wrong because built-in NGFW certificates are self-signed or CA certs - they are not the certificates tied to your application/database servers, and the firewall still lacks those servers' private keys.
• Option D is fundamentally wrong: asymmetric decryption is mathematically impossible without the correct private key.

Memory tip: Think of Inbound Inspection as the firewall "standing in" for the server - it can only do that if you hand it the server's own ID (certificate + private key). No key = no decryption. The mnemonic "Inbound = Inside server's key" helps distinguish it from outbound/forward proxy, which uses a CA cert instead.

No community discussion yet for this question.