10.3 Evaluate SSL Decryption Versus Performance Trade-Offs NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A network engineer is troubleshooting high latency on a firewall that performs SSL decryption. The firewall has a hardware crypto engine, and the engineer has already disabled weak ciphers. The latency is still high. Which next step is most likely to identify the bottleneck?

   • ADisable SSL decryption for all traffic to see if latency improves.
   • BEnable more detailed logging to see which sessions are experiencing latency.
   • CCheck the firewall's CPU usage to see if the crypto engine is being utilized.
   • DIncrease the firewall's buffer size to improve throughput.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A university is deploying SSL decryption on its campus firewall. The firewall is used by students, faculty, and staff. The security team wants to decrypt traffic to social media and file-sharing sites to prevent malware distribution, but they are concerned about the performance impact on the 10 Gbps link. Which approach is most effective?

   • ADecrypt traffic to specific URL categories like 'social-networking' and 'file-sharing'.
   • BDecrypt all HTTPS traffic to ensure no malware is missed.
   • CDecrypt traffic only from students, as they are more likely to visit risky sites.
   • DDecrypt traffic only during peak hours to reduce the impact.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does hardware acceleration for SSL decryption influence the performance trade-off of enabling SSL decryption?

   • AIt eliminates the need for SSL decryption entirely.
   • BIt increases the performance impact because the hardware must be configured.
   • CIt has no effect on performance because SSL decryption is always performed in software.
   • DIt reduces the performance impact of SSL decryption by offloading cryptographic operations.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a potential limitation when a firewall handles a high volume of encrypted sessions with SSL decryption enabled?

   • AThe firewall will increase the session timeout to handle more sessions.
   • BThe firewall will drop all encrypted sessions if the volume exceeds a certain threshold.
   • CThe firewall will automatically disable SSL decryption when the session limit is reached.
   • DThe firewall may run out of memory for session tables because each decrypted session requires more state.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A large e-commerce company is deploying SSL decryption on its data center firewall. The firewall will handle millions of short-lived HTTPS connections from customers. The security team is concerned about the impact on session establishment and connection limits. Which action will most effectively mitigate the performance impact?

   • AEnable SSL session resumption to reduce the number of full handshakes.
   • BDisable SSL decryption for all traffic except for a few high-risk categories.
   • CIncrease the firewall's session table size to accommodate more concurrent connections.
   • DUse a load balancer in front of the firewall to distribute SSL decryption across multiple devices.
   Reveal Solution Discussion Select an answer first