A hospital network uses Cisco WSA for web traffic. They must comply with HIPAA and avoid decrypting patient portal traffic. They also want to decrypt all other web traffic for malware inspection. What is the most appropriate configuration?

Bypass decryption for all traffic to avoid any compliance issues.

Use a separate proxy for patient portal traffic.

Decrypt all traffic including patient portal to ensure full security.

Create a decryption policy that bypasses decryption for the patient portal domain and decrypts all other traffic.

After configuring SSL decryption on Cisco FTD, a security analyst notices that some traffic is not being decrypted even though the policy matches. The FTD logs show 'no decryption' for those sessions. What is the most likely cause?

The traffic is using an unsupported cipher suite or TLS version.

The decryption policy is applied to the wrong interface.

The users' browsers do not trust the FTD CA.

The destination server is using certificate pinning.

A company is deploying Cisco FTD with SSL decryption for all outbound traffic. The security team notices that the FTD CPU is consistently at 90% and latency is increasing. They want to maintain security inspection but reduce performance impact. What should they do first?

Use decryption rules to exclude high-volume, low-risk traffic such as software updates.

Upgrade the FTD hardware to a larger model.

Increase the number of concurrent connections allowed.

Disable all decryption to eliminate CPU usage.

Users report that some HTTPS sites show a 'connection not secure' warning in the browser when going through Cisco WSA. The WSA is configured for SSL decryption. What is the most likely cause?

The WSA's decryption certificate is not trusted by the client machines.

The destination site has an invalid certificate.

The WSA is not configured to decrypt HTTPS traffic.

The WSA is blocking the site due to URL filtering.

A company uses Cisco Umbrella for DNS-layer security and wants to add HTTP decryption and inspection for web traffic. They have Cisco WSA on-premises. What is the recommended integration approach?

Use Umbrella to decrypt traffic and send it to WSA.

Forward traffic from WSA to Umbrella for cloud-based inspection after decryption.

Use Umbrella's virtual appliance to replace WSA.

Configure Umbrella to bypass WSA for all traffic.

CCIE Security

Domain 5Objective 8

5.8 HTTP Decryption and Inspection on Cisco FTD, Cisco WSA, and Cisco Umbrella CCIE-SECURITY Practice Questions (Page 9)

Part of the 5.0 Advanced Threat Protection and Content Security domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

20%of the exam

Questions 41–45

41application · medium
A hospital network uses Cisco WSA for web traffic. They must comply with HIPAA and avoid decrypting patient portal traffic. They also want to decrypt all other web traffic for malware inspection. What is the most appropriate configuration?
Select an answer first
42expert · hard
After configuring SSL decryption on Cisco FTD, a security analyst notices that some traffic is not being decrypted even though the policy matches. The FTD logs show 'no decryption' for those sessions. What is the most likely cause?
Select an answer first
43application · medium
A company is deploying Cisco FTD with SSL decryption for all outbound traffic. The security team notices that the FTD CPU is consistently at 90% and latency is increasing. They want to maintain security inspection but reduce performance impact. What should they do first?
Select an answer first
44application · medium
Users report that some HTTPS sites show a 'connection not secure' warning in the browser when going through Cisco WSA. The WSA is configured for SSL decryption. What is the most likely cause?
Select an answer first
45application · medium
A company uses Cisco Umbrella for DNS-layer security and wants to add HTTP decryption and inspection for web traffic. They have Cisco WSA on-premises. What is the recommended integration approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.