10.3 Evaluate SSL Decryption Versus Performance Trade-Offs NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is comparing two firewall models for SSL decryption. Model A has a dedicated crypto engine, while Model B relies on general-purpose CPUs. Both models have the same session limit. The company expects a high volume of HTTPS traffic with large file transfers. Which model is likely to provide better performance for this workload?

   • AModel B, because general-purpose CPUs are more flexible for different types of traffic.
   • BModel B, because it can use the CPU for other tasks like inspection.
   • CModel A, because the dedicated crypto engine can handle the cryptographic operations more efficiently.
   • DBoth models will perform the same, as the session limit is the same.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary reason SSL decryption increases the latency of traffic passing through a firewall?

   • AThe firewall must decrypt inbound traffic, inspect it, and then re-encrypt it before forwarding.
   • BThe firewall must send a copy of all decrypted traffic to a central logging server.
   • CThe firewall must perform a DNS lookup for every decrypted session.
   • DThe firewall must store all decrypted traffic in memory for compliance purposes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security administrator is tuning SSL decryption on a PA-Series firewall. The firewall is experiencing high CPU usage and latency. The administrator has already enabled hardware crypto acceleration. Which tuning option is most likely to reduce the performance impact?

   • AIncrease the firewall's buffer size to handle more data per session.
   • BEnable SSL decryption for all traffic to ensure consistent inspection.
   • CDisable weak ciphers and protocols, such as SSLv3 and RC4, to reduce the number of supported algorithms.
   • DIncrease the session timeout to keep sessions open longer.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary benefit of selectively decrypting only specific traffic, such as traffic for a particular URL category?

   • AIt reduces the performance impact of SSL decryption by limiting the amount of traffic that must be decrypted.
   • BIt ensures that all traffic is decrypted for maximum security.
   • CIt increases the performance impact because more rules are required.
   • DIt eliminates the need for SSL decryption entirely.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which criterion is commonly used to selectively decrypt traffic in order to balance security and performance?

   • AThe time of day the traffic occurs
   • BThe physical port the traffic enters on
   • CThe source and destination IP addresses only
   • DThe application or URL category of the traffic
   Reveal Solution Discussion Select an answer first