3.04 Articulate Architectural Requirements for Outbound SSL Visibility 401 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is deploying outbound SSL inspection. They have a requirement to log all decrypted traffic for compliance purposes. What is the BEST way to achieve this on the BIG-IP?

   • AEnable the SSL forward proxy profile and rely on the default logging.
   • BConfigure the BIG-IP to store the decrypted traffic locally on its hard drive.
   • CUse an iRule to log the decrypted payload to a remote logging server.
   • DUse a network TAP to capture the decrypted traffic after the BIG-IP.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security architect is designing an outbound SSL inspection solution. They need to ensure that the BIG-IP can decrypt traffic that uses TLS 1.3, which has a feature called '0-RTT' (Zero Round Trip Time). What is a potential challenge with this?

   • AThe BIG-IP cannot support TLS 1.3 at all.
   • BThe BIG-IP must use a hardware security module (HSM) to decrypt 0-RTT data.
   • CThe BIG-IP must be configured to use a specific cipher suite to support 0-RTT.
   • DThe BIG-IP may not be able to decrypt 0-RTT data because it is sent before the handshake is complete.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security architect is designing an outbound SSL inspection solution for a large enterprise. The requirement is to inspect all outbound traffic, but the team is concerned about the performance impact on the BIG-IP. Which architectural consideration is MOST important to address this concern?

   • ASize the BIG-IP platform with sufficient SSL/TLS processing capacity (e.g., dedicated SSL hardware or high CPU cores).
   • BConfigure the BIG-IP to only decrypt traffic on specific ports, such as 443.
   • CUse a network TAP to send a copy of the traffic to the BIG-IP for inspection.
   • DDeploy the BIG-IP in a high-availability pair and use a hardware security module (HSM) for key storage.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is implementing outbound SSL inspection. They have a mix of managed corporate devices and unmanaged personal devices (BYOD) on the network. The security policy requires inspection of all outbound traffic. What is the MOST effective architectural approach?

   • AInspect traffic from managed devices only, and allow unmanaged devices to bypass inspection.
   • BDeploy the BIG-IP as a transparent forward proxy and do not present any certificate to the clients.
   • CUse a client-side SSL profile with a self-signed certificate for the BYOD devices.
   • DRequire all devices, including BYOD, to install the corporate root CA certificate before accessing the network.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An architect is designing an outbound SSL inspection solution. They need to ensure that the BIG-IP can decrypt traffic that uses Elliptic Curve Cryptography (ECC) and the latest TLS 1.3 protocol. What is the MOST important consideration?

   • AUse a self-signed certificate for the client-side SSL profile.
   • BInstall a hardware security module (HSM) to store the private keys.
   • CConfigure the BIG-IP to only inspect traffic on port 443.
   • DEnsure the BIG-IP software version supports TLS 1.3 and ECC cipher suites.
   Reveal Solution Discussion Select an answer first