10.3 Evaluate SSL Decryption Versus Performance Trade-Offs NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which hardware component is specifically designed to offload SSL/TLS cryptographic operations from the main CPU in a firewall?

   • AA large amount of RAM for session tables
   • BA high-speed network interface card (NIC)
   • CA dedicated crypto engine or cryptographic accelerator
   • DA solid-state drive (SSD) used for logging
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large enterprise is deploying SSL decryption on its perimeter firewall. The firewall must handle a high volume of short-lived HTTPS connections from mobile users. The security team is concerned about the impact on session establishment. They have already enabled session resumption, but the firewall is still experiencing high CPU usage during peak hours. Which additional measure is most effective?

   • AIncrease the firewall's session table size to handle more concurrent connections.
   • BIncrease the session timeout to keep connections open longer.
   • CDeploy multiple firewalls in a cluster to distribute the SSL decryption load.
   • DDisable SSL decryption for traffic from mobile users, as they are less likely to be targeted.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is deploying SSL decryption on its firewall. The firewall is also used for general internet access. The security team wants to decrypt all traffic to external websites, but they are concerned about the performance impact on the 1 Gbps link. The firewall has a hardware crypto engine. Which approach best balances security and performance?

   • ASelectively decrypt traffic based on URL category and application, such as decrypting only high-risk categories like 'malware' and 'phishing'.
   • BDisable SSL decryption entirely and rely on the firewall's signature-based detection on the encrypted payload.
   • CDecrypt only traffic from users in the finance department, as they are the most likely to be targeted by phishing.
   • DEnable SSL decryption for all HTTPS traffic and rely on the hardware crypto engine to maintain near-line-rate throughput.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A service provider is deploying SSL decryption on a firewall that aggregates traffic from multiple customers. The firewall must handle a high volume of concurrent SSL sessions. The provider is concerned about the firewall's connection limit. Which configuration change will most directly increase the number of concurrent SSL sessions the firewall can handle?

   • AEnable SSL session resumption to reduce handshake overhead.
   • BIncrease the firewall's session table size.
   • CUpgrade the firewall's crypto engine to a faster model.
   • DDisable SSL decryption for low-risk traffic to free up resources.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank is deploying a new PA-Series firewall at its main data center to inspect encrypted traffic. The security team wants to decrypt all HTTPS traffic to detect malware, but the network team warns that the firewall's throughput will drop significantly if all traffic is decrypted. The bank's internet link is 10 Gbps, and the firewall model supports hardware crypto acceleration. Which approach best balances security and performance?

   • ADecrypt only traffic from users in the finance department, as they are the most likely to be targeted by phishing.
   • BEnable SSL decryption for all HTTPS traffic and rely on the hardware crypto engine to maintain near-line-rate throughput.
   • CSelectively decrypt traffic based on URL category and application, such as decrypting only high-risk categories like 'malware' and 'phishing'.
   • DDisable SSL decryption entirely and rely on the firewall's signature-based detection on the encrypted payload.
   Reveal Solution Discussion Select an answer first