1.3 Explain the Use of Decryption on Strata and SASE Products (e.g., SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, No Decrypt) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is implementing SSL Forward Proxy. The administrator has generated a forward trust certificate and installed it on all user devices. However, when users access a site with a self-signed certificate, the firewall blocks the connection. What is the most likely reason?

   • AThe forward trust certificate is not installed in the users' browser, only in the operating system's store.
   • BThe firewall is configured to block sessions when the server's certificate is untrusted.
   • CThe firewall's decryption policy is set to 'No Decrypt' for self-signed certificates.
   • DThe users' browsers do not support the TLS version used by the self-signed certificate.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses Prisma Access (SASE) to secure remote users. They want to decrypt and inspect all outbound HTTPS traffic from remote users, but they are concerned about the performance impact on users with high-latency connections. What is the most effective way to address this concern while maintaining security?

   • AConfigure SSL Forward Proxy in Prisma Access and enable the 'No Decrypt' option for traffic to high-bandwidth streaming sites.
   • BConfigure the firewall to only decrypt traffic from users with a specific IP address range.
   • CUse SSL Inbound Inspection instead of SSL Forward Proxy for remote users.
   • DDisable SSL Forward Proxy for all remote users and rely on URL filtering only.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of placing a 'No Decrypt' rule at the top of the decryption policy?

   • ATo ensure that all traffic is decrypted by default.
   • BTo allow security policy to inspect the traffic without decryption.
   • CTo ensure that specific traffic is never decrypted, even if later rules would match it.
   • DTo improve performance by skipping decryption for all traffic.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization hosts a customer-facing web application on an internal server. They want to inspect inbound HTTPS traffic for SQL injection attempts before it reaches the server. The server's certificate is issued by a public CA. What must be configured on the Palo Alto Networks firewall to enable SSL Inbound Inspection?

   • AInstall the firewall's forward trust certificate on the server and create an SSL Inbound Inspection rule.
   • BGenerate a new self-signed certificate on the firewall and use it in the SSL Inbound Inspection rule.
   • CConfigure the server to use TLS 1.3 and create a decryption rule with the 'No Decrypt' action for inbound traffic.
   • DImport the server's private key and certificate onto the firewall, then create an SSL Inbound Inspection rule for the server's IP and port.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Palo Alto Networks Strata firewall is configured with SSL Forward Proxy. The administrator wants to ensure that the firewall can inspect HTTPS traffic from users who are connecting through a web proxy. What must be configured?

   • ADisable SSL Forward Proxy and rely on the web proxy's own decryption capabilities.
   • BConfigure the web proxy to forward traffic to the firewall using SSL Inbound Inspection.
   • CCreate a 'No Decrypt' rule for the web proxy's IP address.
   • DEnsure the firewall's decryption policy includes the users' source IP addresses and that the forward trust certificate is installed on their devices.
   Reveal Solution Discussion Select an answer first