5.8 HTTP Decryption and Inspection on Cisco FTD, Cisco WSA, and Cisco Umbrella CCIE-SECURITY Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A security administrator is configuring Cisco FTD to inspect decrypted HTTPS traffic for malware and intrusions. They want to ensure that the inspection is applied to all decrypted traffic. What must be configured?

   • AConfigure a new access control rule to block all HTTPS traffic.
   • BUse a separate interface for decrypted traffic.
   • CDisable decryption for traffic that needs inspection.
   • DEnable the appropriate security intelligence and intrusion prevention policies on the decrypted traffic.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A European company must comply with GDPR. They are deploying SSL decryption on Cisco WSA. What is a mandatory requirement?

   • AStore decrypted traffic logs for at least one year.
   • BDecrypt all traffic without exception to ensure compliance.
   • CObtain explicit consent from every user before decryption.
   • DInform users that their web traffic is subject to decryption and monitoring.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company wants to decrypt only traffic from the finance department to external websites, but not decrypt traffic from other departments. They use Cisco FTD. What is the most efficient way to achieve this?

   • ACreate a decryption policy that matches the finance department's source IP addresses and decrypts only that traffic.
   • BUse a separate FTD for finance traffic.
   • CDecrypt all traffic and then block non-finance traffic.
   • DConfigure the finance department's browsers to use a proxy.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A user is trying to access a website that uses certificate pinning. The traffic goes through Cisco WSA with SSL decryption. What is the likely outcome?

   • AThe website will load but without encryption.
   • BThe website may fail to load or show an error because the pinned certificate does not match the one presented by WSA.
   • CThe website will load normally because WSA uses the original certificate.
   • DThe website will be automatically bypassed from decryption.
   Reveal Solution Discussion Select an answer first