10.8 Evaluate SSL Inspection Sizing Requirements NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which factor has the most direct impact on the CPU processing load during SSL decryption on a Palo Alto Networks firewall?

   • AThe cipher suite and key length used for the SSL session
   • BThe number of concurrent SSL sessions
   • CThe size of the SSL session cache
   • DThe number of SSL certificates installed on the firewall
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary impact of enabling SSL decryption on a Palo Alto Networks firewall's CPU?

   • ACPU usage remains unchanged because decryption is handled by dedicated hardware in all models.
   • BCPU usage increases due to the cryptographic operations required for decryption and re-encryption.
   • CCPU usage decreases because decryption offloads work to the network interface cards.
   • DCPU usage increases only for the initial handshake, not for the data transfer.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When sizing SSL inspection, why is it important to consider mixed traffic types?

   • ADifferent traffic types have varying SSL session lengths and transaction sizes, which affect the required throughput and session table size.
   • BMixed traffic types are not supported by SSL decryption.
   • CMixed traffic types require different SSL certificates, which affects throughput.
   • DMixed traffic types require multiple decryption policies, which consume more CPU.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement accurately compares the SSL inspection capabilities of PA-Series and VM-Series firewalls?

   • APA-Series firewalls do not support SSL decryption.
   • BVM-Series firewalls always provide higher SSL throughput than PA-Series firewalls.
   • CPA-Series firewalls use dedicated hardware acceleration for SSL decryption, while VM-Series relies on the host CPU.
   • DVM-Series firewalls can decrypt SSL traffic at the same rate as the highest-end PA-Series models.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A firewall administrator is troubleshooting a performance issue on a PA-Series firewall after enabling SSL decryption. They notice that the firewall's dataplane CPU is at 90% utilization, but the management plane CPU is low. What is the most likely impact of this situation?

   • AThe firewall will fail to log traffic, because the dataplane is responsible for logging.
   • BThe firewall will drop all traffic, because the dataplane is overloaded.
   • CThe firewall will continue to pass traffic but with increased latency and potential session drops.
   • DThe firewall will automatically disable SSL decryption to protect itself.
   Reveal Solution Discussion Select an answer first