5.8 HTTP Decryption and Inspection on Cisco FTD, Cisco WSA, and Cisco Umbrella CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After enabling SSL decryption on Cisco FTD, some users cannot connect to a critical business application. The application uses client certificates for authentication. What is the most likely issue?

   • AThe server certificate is expired.
   • BThe users' browsers do not trust the FTD's CA.
   • CThe FTD is blocking the application due to IPS rules.
   • DThe FTD is not forwarding the client certificate to the server.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A large enterprise is deploying SSL decryption on a pair of Cisco FTDs in high availability. They have a mix of high-bandwidth and low-bandwidth traffic. They want to maximize inspection while minimizing latency. What is the best approach?

   • ADisable IPS on decrypted traffic to improve performance.
   • BUse decryption policies to selectively decrypt only traffic that requires inspection, and offload decryption to dedicated hardware if available.
   • CUse only one FTD for decryption to avoid synchronization issues.
   • DDecrypt all traffic to ensure complete visibility.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A financial services company is required to decrypt traffic for security but must not decrypt traffic to banking sites due to regulatory requirements. They also need to ensure that users cannot bypass decryption by using alternate domains. What is the best way to handle this?

   • AUse a separate proxy for banking traffic.
   • BBypass decryption for all traffic to avoid any regulatory issues.
   • CDecrypt all traffic and rely on the security team to manually review logs.
   • DCreate a decryption bypass rule for known banking domains and enforce a strict URL filtering policy to block access to unknown financial sites.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company uses Cisco Umbrella and Cisco WSA. They want to ensure that decrypted traffic is also inspected by Umbrella's cloud security. However, they are concerned about the additional latency of sending all decrypted traffic to the cloud. What is the best practice?

   • ASend all decrypted traffic to Umbrella to ensure maximum security.
   • BConfigure WSA to forward only traffic that requires cloud inspection to Umbrella, using selective forwarding based on policy.
   • CDisable cloud inspection to avoid latency.
   • DUse Umbrella as the primary decryption point and bypass WSA.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   Users report that some HTTPS sites are intermittently failing to load through Cisco WSA. The WSA logs show 'SSL handshake failure' for those sites. What is the most likely cause?

   • AThe sites are using TLS 1.3, which WSA cannot decrypt.
   • BThe WSA is overloaded and dropping connections.
   • CThe WSA's decryption certificate has expired or is not valid for the site.
   • DThe users' browsers are not configured to trust the WSA CA.
   Reveal Solution Discussion Select an answer first