lesson 7

Question 1

pan-os ssl decryption

Answer 1

-ssl/tls sessions can be decrypted and inspected to enforce security policy

Question 2

decryption types

Answer 2

• ssl forward proxy (outbound)
• ssl inbound inspection
• ssh decryption

Question 3

certificate chain of trust

Answer 3

• hierarchical list of certificates used to authenticate
• if a device contains the certificates of the root ca and intermediate ca it can verify a certificate within the chain of trust

Question 4

certificate verification steps

Answer 4

• determine chain of trust

- validate each certificate based on: valid signature, valid expiry date, no malformation or corruption, not revoked

Question 5

certificate revocation reasons

Answer 5

• compromised key

- failed verification

Question 6

preferred way to acquire a certificate in pan-os

Answer 6

• generate a certificate signing request (csr)

- have the csr signed by a ca

Question 7

csr process

Answer 7

• generate csr on device
• sign identity info with private key
• send csr to ca
• ca signs and returns the csr
• signed request is installed on device

Question 8

certificate deployment option 1

Answer 8

-obtain a signing certificate from a third party ca

Question 9

certificate deployment option 2

Answer 9

-use an internal ca to issue a signing certificate to the firewall

Question 10

certificate deployment option 3

Answer 10

-generate a self signing certificate

Question 11

ssl forward proxy decryption

Answer 11

• decrypts and inspects ssl/tls traffic from internal users destined for external web servers
• firewall first requests and verifies the external servers’ certificate, resulting in connection between firewall and server
• firewall then signs the server’s certificate with its own and sends it to the client
• the client verifies the firewall’s certificate, resulting in a connection between the client and firewall
• if the server does not present a trusted certificate the firewall signs with untrust certificate and a block page is generated
• the user can choose to proceed or terminate

Question 12

ssl inbound inspection

Answer 12

• used to check ssl connections from external hosts for threats
• firewall requires copy of server’s public and private keys which allows the firewall to decrypt traffic in both directions
• a decryption policy rule can be defined to inspect incoming ssl/tls connections

Question 13

ssl inbound inspection unsupported applications

Answer 13

• apps that use client side certificates
• non-rfc-compliant apps
• servers using unsupported cryptographic settings

Question 14

no decryption

Answer 14

• a decryption profile can be used to enforce minimum ssl security without having to decrypt the traffic
• sessions with expired certificates, or untrusted issuers will be blocked

Question 15

wildfire threat intelligence cloud

Answer 15

• unknown file and url links from web traffic and email are automatically sent to wildfire threat intelligence cloud servers
• the cloud analyses and generates malware signatures and verdicts
• files can also be manually uploaded to wildfire for analyses

Question 16

wildfire markings

Answer 16

• benign, does not exhibit malice
• greyware, similar to malware but is not considered malicious
• malware
• phishing