A company is implementing SSL inspection and wants to ensure that their internal CA certificate is trusted by all devices. They have a mix of Windows, macOS, and Linux devices. What is the best way to distribute the CA certificate?

Disable SSL inspection for devices that do not have the certificate.

Manually install the certificate on each device.

Use group policy for Windows, MDM for macOS and Linux.

Use a public CA to sign the firewall's certificate.

A retail company's firewall is configured to block traffic from countries where the company does not do business. However, they are seeing attacks that appear to originate from a legitimate partner's IP range in a neighboring country. The geolocation database is up to date. What is the most likely reason the attacks are not being blocked?

The attacker is using a VPN or proxy to appear as if they are from the partner's country.

The firewall's geolocation feature is disabled.

The partner's IP range is not in the block list.

The geolocation database is incorrect for that IP range.

A company's firewall is not correctly identifying a custom internal application that uses a proprietary protocol over TLS. The AVC engine is updated, but the application is still classified as 'unknown'. What should you do to ensure the firewall can control this application?

Block all unknown traffic to prevent the application from functioning.

Create a custom application signature based on the protocol's unique characteristics.

Enable SSL decryption to inspect the TLS traffic and then rely on heuristics.

Use behavioral analysis to detect the application based on traffic patterns.

A financial institution wants to inspect SSL traffic for malware but is concerned about the performance impact of full decryption. They also need to ensure that sensitive customer data is not stored in logs. Which SSL inspection method should they use?

Use SSL decryption with a trusted CA and disable logging for all decrypted traffic.

Full man-in-the-middle decryption with selective logging of sensitive fields.

Passive inspection using a SPAN port to analyze traffic without decrypting it.

Decrypt only traffic to specific high-risk destinations and use passive inspection for the rest.

A university is implementing SSL inspection on their firewall. They want to ensure that students cannot bypass inspection by using personal certificates. What is the best practice to prevent this?

Allow users to add their own trusted CA certificates to the firewall's list.

Use passive inspection to avoid the need for certificates.

Block all traffic that uses certificates not issued by the firewall.

Install the firewall's CA certificate on all student devices and disable user certificate trust.

CCIE Security

Domain 1Objective 6

1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 11)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

11concepts

20%of the exam

Questions 51–55

51application · medium
A company is implementing SSL inspection and wants to ensure that their internal CA certificate is trusted by all devices. They have a mix of Windows, macOS, and Linux devices. What is the best way to distribute the CA certificate?
Select an answer first
52application · medium
A retail company's firewall is configured to block traffic from countries where the company does not do business. However, they are seeing attacks that appear to originate from a legitimate partner's IP range in a neighboring country. The geolocation database is up to date. What is the most likely reason the attacks are not being blocked?
Select an answer first
53application · medium
A company's firewall is not correctly identifying a custom internal application that uses a proprietary protocol over TLS. The AVC engine is updated, but the application is still classified as 'unknown'. What should you do to ensure the firewall can control this application?
Select an answer first
54application · medium
A financial institution wants to inspect SSL traffic for malware but is concerned about the performance impact of full decryption. They also need to ensure that sensitive customer data is not stored in logs. Which SSL inspection method should they use?
Select an answer first
55application · medium
A university is implementing SSL inspection on their firewall. They want to ensure that students cannot bypass inspection by using personal certificates. What is the best practice to prevent this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.