1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is certificate pinning in the context of SSL inspection?

   • AA way to generate new certificates for clients
   • BA technique to prevent a firewall from decrypting traffic to specific sites
   • CA method to speed up SSL handshakes
   • DA process to revoke compromised certificates
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common source for user identity information on a Cisco NGFW?

   • ASNMP
   • BDNS
   • CDHCP
   • DActive Directory
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services firm must inspect all inbound HTTPS traffic to its public web servers for malware, but must not break the client's trust in the certificate chain. The security team has a corporate CA that is already distributed to all internal clients. However, external customers also access these servers. What should the administrator configure on the Cisco NGFW to ensure external customers' HTTPS traffic is inspected without certificate errors?

   • AConfigure SSL inspection to decrypt traffic only for internal users, and use a passive (non-decrypting) inspection method for external traffic.
   • BEnable SSL inspection with a decryption policy that re-signs the server certificate using the corporate CA, and add the corporate CA to the trusted CA list on the NGFW.
   • CDisable SSL inspection for all traffic and rely on URL filtering to block malicious sites.
   • DUse a decryption policy that forwards the original server certificate to the client and performs inspection without re-encryption.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is evaluating whether to implement SSL inspection on their NGFW. They are concerned about the performance impact and the complexity of managing certificates. What is the primary benefit that justifies the implementation?

   • AIt improves network performance by caching encrypted content.
   • BIt allows the NGFW to block encrypted malware and prevent data exfiltration.
   • CIt simplifies certificate management by automatically trusting all certificates.
   • DIt eliminates the need for other security controls.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large enterprise is deploying SSL inspection on a pair of Cisco NGFWs in high availability. They have a mix of internal and external users. The compliance team requires that all traffic to financial applications be inspected, but the legal team requires that traffic to healthcare portals be excluded due to privacy regulations. The NGFW must also handle certificate pinning for certain applications. What is the most effective way to configure SSL inspection policies?

   • ACreate a single decryption policy for all traffic and use certificate pinning to exclude healthcare.
   • BCreate a decryption policy that excludes healthcare domains, then a policy that decrypts all other traffic, and configure certificate pinning to bypass inspection for pinned applications.
   • CDecrypt all traffic, including healthcare, and rely on logging to ensure compliance.
   • DUse passive inspection for all traffic to avoid decryption issues.
   Reveal Solution Discussion Select an answer first