3.04 Articulate Architectural Requirements for Outbound SSL Visibility 401 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which architectural component is essential for an organization to inspect outbound SSL traffic for malware and data exfiltration?

   • AA firewall rule that blocks all outbound SSL/TLS traffic to untrusted destinations
   • BAn SSL/TLS interception proxy that terminates outbound connections and re-encrypts them after inspection
   • CA network TAP that copies all outbound traffic to a passive monitoring tool
   • DA certificate revocation list (CRL) configured on the client devices
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm must inspect all outbound HTTPS traffic from its internal users for data exfiltration. The security team wants to decrypt traffic, apply policy, and re-encrypt before it leaves the network. They have a BIG-IP deployed as an explicit forward proxy. Which architectural element is REQUIRED for the BIG-IP to successfully decrypt and inspect this outbound SSL traffic?

   • ADeploy a network TAP on the internet link and configure the BIG-IP to passively reassemble SSL streams.
   • BEnable the SSL forward proxy profile and set the client SSL profile to use a self-signed certificate.
   • CInstall the corporate root CA certificate on all internal client devices and configure an SSL forward proxy profile on the BIG-IP.
   • DConfigure the BIG-IP with a valid public certificate for each internal server, and use an SSL origin server profile.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security engineer is configuring outbound SSL inspection. They want to ensure that the BIG-IP can decrypt traffic to a specific server that uses a client certificate for authentication. What must be configured on the BIG-IP?

   • AInstall the destination server's certificate on the BIG-IP.
   • BDisable the SSL forward proxy profile for that specific server.
   • CUse a network TAP to capture the traffic and replay it with a client certificate.
   • DConfigure the client SSL profile to present a client certificate to the destination server.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is implementing outbound SSL inspection. They want to ensure that the BIG-IP can enforce policies based on the content of the decrypted traffic. Which feature is REQUIRED for this?

   • AAn SSL origin server profile to re-encrypt the traffic.
   • BA network TAP to capture the decrypted traffic for analysis.
   • CAn iRule that inspects the decrypted payload and takes action.
   • DA hardware security module (HSM) to store the decryption keys.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise is deploying outbound SSL inspection. They have a requirement to inspect all traffic, but they also have a strict compliance requirement that prohibits the storage of decrypted financial data. The security team is concerned about the BIG-IP's local logs. What is the MOST appropriate architectural control?

   • AUse a network TAP to capture the decrypted traffic and store it on a secure server.
   • BConfigure the BIG-IP to not log any decrypted payload and only log connection metadata.
   • CEncrypt the local logs on the BIG-IP to protect the decrypted data.
   • DUse an iRule to log all decrypted payload to a remote server that is compliant.
   Reveal Solution Discussion Select an answer first