2.3 Create and Apply Decryption Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   After deploying a decryption policy, an analyst notices that some HTTPS sessions are not being decrypted and the traffic logs show 'Decryption Mismatch' as the action. What does this indicate, and what should the analyst do?

   • AThe client did not trust the decryption certificate, so the session was allowed without decryption; the analyst should distribute the CA certificate.
   • BThe security policy blocked the session because decryption was not possible; the analyst should modify the security policy.
   • CThe traffic matched a decryption policy, but the session could not be decrypted due to a handshake failure; the analyst should review the decryption profile's failure settings.
   • DThe traffic did not match any decryption policy, so it was passed without decryption; the analyst should create a broader decryption policy.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which setting in a decryption profile controls what happens when the firewall cannot decrypt a session?

   • AKey exchange algorithm settings
   • BSSL/TLS version settings
   • CCertificate settings
   • DFailure handling
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to decrypt inbound HTTPS traffic to their public-facing web server for threat inspection. They have a valid certificate for the web server. What type of decryption policy should they create?

   • AInbound decryption policy with the web server's IP as the destination and the server's certificate configured in the decryption profile.
   • BA 'No Decrypt' policy for the web server's IP to allow the traffic without inspection.
   • CForward proxy decryption policy with the web server's IP as the source.
   • DA security policy rule that allows HTTPS to the web server and enables decryption.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is planning to deploy SSL decryption for outbound traffic. They are concerned about legal and compliance issues with inspecting personal traffic. What is the best practice to address this concern?

   • AEnable 'No Decrypt' for all traffic and rely on security policies to inspect without decryption.
   • BCreate a 'No Decrypt' policy for categories such as 'personal' or 'health' and place it above the decrypt policy.
   • CDecrypt all traffic but do not log any decrypted content.
   • DUse a decryption profile that blocks all sessions to personal websites.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is NOT a typical component of a decryption policy rule?

   • ADestination zone and address
   • BSource zone and address
   • CService (port)
   • DAction (allow or deny)
   Reveal Solution Discussion Select an answer first