1.3 Explain the Use of Decryption on Strata and SASE Products (e.g., SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, No Decrypt) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a SASE (cloud-delivered) security product, how is decryption typically managed?

   • AThrough manual certificate installation on every endpoint.
   • BThrough local firewall configuration at each branch office.
   • CThrough cloud-based policy configuration, applied consistently across all locations.
   • DThrough a dedicated hardware appliance at each site.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Palo Alto Networks Strata firewall is configured with SSL Forward Proxy. The administrator wants to ensure that traffic to a specific internal server is NOT decrypted because the server uses a custom certificate that is not trusted by the firewall. What is the correct configuration?

   • ACreate a 'No Decrypt' rule for the internal server's IP address and place it above the general SSL Forward Proxy rule.
   • BImport the internal server's certificate as a trusted certificate on the firewall.
   • CConfigure the firewall to block traffic to the internal server.
   • DCreate a security policy rule that allows traffic to the internal server before the decryption policy is evaluated.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the role of a forward trust certificate in SSL Forward Proxy decryption?

   • AIt is used to encrypt the decrypted traffic before sending it to the server.
   • BIt is used to validate the external server's certificate.
   • CIt is presented to internal clients to establish trust for the decrypted session.
   • DIt is used to sign the firewall's configuration.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key advantage of decryption in a SASE product compared to on-premises decryption?

   • AIt only decrypts traffic from managed devices.
   • BIt can decrypt traffic without any performance impact.
   • CCentralized policy management and consistent enforcement across all users and locations.
   • DIt eliminates the need for certificate management.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   On a Palo Alto Networks Strata firewall, where is decryption policy configured?

   • AIn the Security policy section, as a security rule action.
   • BIn the QoS policy section, as a traffic shaping rule.
   • CIn the NAT policy section, as a translation rule.
   • DIn the Decryption policy section, separate from Security policy.
   Reveal Solution Discussion Select an answer first