10.8 Evaluate SSL Inspection Sizing Requirements NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which metric is most relevant for sizing the session table when planning SSL inspection?

   • AAverage SSL transaction size
   • BSSL session timeout value
   • CNew SSL sessions per second
   • DConcurrent SSL sessions
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is planning to deploy a new firewall for SSL inspection. They have two candidate models: Model A has a high SSL decryption throughput but a low session rate, and Model B has a lower SSL decryption throughput but a high session rate. The company's traffic is a mix of 50% small transactions (e.g., API calls) and 50% large transactions (e.g., file transfers). They expect a 20% annual growth in traffic. Which model should they choose?

   • AModel A, because high SSL decryption throughput is more important for large transactions.
   • BChoose the model with the higher raw firewall throughput, because SSL decryption performance is secondary.
   • CChoose a model that balances both SSL decryption throughput and session rate to handle the mixed traffic.
   • DModel B, because high session rate is more important for small transactions.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which feature can significantly reduce the CPU overhead of SSL decryption by avoiding repeated full TLS handshakes?

   • ASSL session mirroring
   • BSSL certificate revocation checking
   • CSSL protocol version downgrade
   • DSSL session reuse
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization is sizing a new firewall for SSL inspection. They have analyzed their traffic and found that 70% of their HTTPS traffic is from web browsing with small transactions, and 30% is from file transfers with large transactions. They also expect a 20% annual growth in traffic. Which approach best estimates the SSL inspection sizing requirement?

   • ASelect a model based on the raw firewall throughput, because SSL decryption is a software feature that does not affect hardware sizing.
   • BUse the peak HTTPS throughput and apply a growth factor, then select a model with SSL decryption throughput that exceeds that value.
   • CUse the session rate only, because SSL decryption performance is primarily limited by the number of new sessions per second.
   • DUse the average HTTPS throughput and select a model with SSL decryption throughput that matches that value.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which best practice should be applied when sizing SSL inspection to accommodate future growth?

   • AInclude a growth margin (e.g., 20-30%) above the current SSL traffic volume.
   • BSelect the smallest model that supports SSL decryption to reduce cost.
   • CSize the firewall to the current SSL traffic volume only to minimize cost.
   • DAssume that SSL traffic will remain constant over time.
   Reveal Solution Discussion Select an answer first