5.8 HTTP Decryption and Inspection on Cisco FTD, Cisco WSA, and Cisco Umbrella CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization is deploying Cisco FTD with HTTPS decryption. They want to ensure that decrypted traffic is inspected by the intrusion prevention system (IPS) and malware detection. They also want to minimize performance impact. What is the best way to configure this?

   • ADisable IPS and malware inspection on decrypted traffic to save resources.
   • BEnable IPS and malware inspection only on traffic that matches a decryption policy, and bypass decryption for low-risk categories.
   • CEnable IPS and malware inspection on all decrypted traffic, but use a high-performance model.
   • DUse a separate IPS device for all decrypted traffic.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial services company is implementing HTTPS inspection on Cisco WSA. They must comply with PCI DSS and avoid decrypting traffic to banking and payment sites. They also want to decrypt other web traffic for security. What is the best way to handle this?

   • ADisable decryption for all traffic to avoid compliance issues.
   • BCreate a decryption bypass rule for known banking and payment domains.
   • CDecrypt all traffic and rely on the WSA's DLP to redact sensitive data.
   • DUse a certificate pinning list to allow banking sites to be decrypted.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is using Cisco FTD for HTTPS decryption. They have a custom internal CA and want to decrypt traffic to internal servers. They have installed the internal CA certificate on the FTD. However, users still see certificate errors when accessing internal HTTPS sites. What is the likely issue?

   • AThe FTD is not configured to decrypt traffic to internal servers.
   • BThe FTD's generated CA certificate is not trusted by the clients.
   • CThe internal CA certificate is not valid.
   • DThe FTD is using the wrong decryption policy for internal traffic.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A large enterprise is planning to deploy HTTPS decryption on Cisco WSA for 10,000 users. They are concerned about the performance impact on the WSA. What is the best practice to ensure scalability?

   • AUse a single WSA with maximum hardware specifications.
   • BDisable decryption for all traffic to avoid performance issues.
   • CUse a separate decryption device in front of the WSA.
   • DDeploy multiple WSAs in a cluster and load balance traffic.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is deploying Cisco FTD with SSL decryption. Users report that some internal applications fail with certificate errors. The internal CA used for re-signing decrypted certificates is not trusted by the application servers. What should you do to resolve this issue?

   • AAdd the internal CA certificate to the trust store of the application servers.
   • BChange the decryption policy to decrypt only inbound traffic.
   • CDisable decryption for the internal application traffic.
   • DConfigure FTD to use the original server certificate instead of re-signing.
   Reveal Solution Discussion Select an answer first