5.8 HTTP Decryption and Inspection on Cisco FTD, Cisco WSA, and Cisco Umbrella CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses Cisco Umbrella for cloud-based security and wants to integrate it with their Cisco WSA for HTTPS inspection. They want to ensure that decrypted traffic is also checked against Umbrella's security policies. What is the recommended way to achieve this?

   • AUse the Umbrella module on the WSA to enforce security based on the destination domain.
   • BConfigure the WSA to forward decrypted traffic to Umbrella via a GRE tunnel.
   • CConfigure the WSA to send all decrypted traffic to Umbrella's API for analysis.
   • DDisable decryption and rely on Umbrella's DNS-layer security.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A hospital is implementing HTTPS inspection on Cisco WSA. They must comply with HIPAA and avoid decrypting patient portal traffic. They also want to decrypt general web traffic for malware protection. What is the best approach?

   • ADecrypt all traffic and rely on the WSA's data loss prevention to redact sensitive data.
   • BCreate a decryption bypass rule for the patient portal domain and decrypt all other traffic.
   • CDisable decryption entirely and use URL filtering only.
   • DUse a transparent proxy without decryption for all traffic.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A large enterprise is deploying Cisco FTD with SSL decryption at the internet edge. They have a high volume of HTTPS traffic and are concerned about performance. They want to ensure that decryption does not become a bottleneck. What is the best practice?

   • ADisable intrusion prevention on decrypted traffic to improve performance.
   • BUse a single FTD device for all decryption to simplify management.
   • CUse decryption bypass for traffic to high-bandwidth sites like video streaming.
   • DEnable decryption on all traffic and use the highest performance model available.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   Users report that some HTTPS sites fail to load after enabling SSL decryption on Cisco WSA. The WSA is configured to decrypt all traffic except banking sites. The error in the browser is 'The certificate is not trusted.' What is the first thing to check?

   • AEnsure the WSA's CA certificate is distributed to all client browsers.
   • BVerify that the banking sites are correctly listed in the bypass list.
   • CConfirm that the WSA has a valid license for decryption.
   • DCheck if the WSA is using the correct upstream proxy.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses Cisco Umbrella for DNS-layer security and wants to integrate it with their Cisco FTD for HTTPS inspection. They want to ensure that decrypted traffic is also checked against Umbrella's cloud-based security. What is the recommended integration approach?

   • AUse the Umbrella module on FTD to enforce security based on the destination domain of decrypted traffic.
   • BConfigure the FTD to send all decrypted traffic to Umbrella's API for analysis.
   • CConfigure the FTD to forward decrypted traffic to Umbrella via an IPsec tunnel.
   • DDisable DNS-layer security and rely solely on FTD inspection.
   Reveal Solution Discussion Select an answer first