Quiz 13 Flashcards
Which feature can be configured to block sessions that the firewall cannot decrypt?
Select one:
a. Decryption profile in security profile
b. Decryption profile in decryption policy
c. Decryption profile in security policy
d. Decryption profile in PBF
Decryption profile in decryption policy
What is default setting for “Action” in a decryption policy rule?
Select one:
a. None
b. No-decrypt
c. Decrypt
d. Any
None
Which type of Next Generation Firewall decryption inspects SSL traffic between an internal host and an external web server?
Select one:
a. SSH
b. SSL Inbound Inspection
c. SSL Outbound Inspection
d. SSL Forward Proxy
SSL Forward Proxy
When SSL encrypted traffic first arrives at the Next Generation Firewall, which technology initially identifies the application as web-browsing?
Select one:
a. User-ID
b. Encryption-ID
c. Content-ID
d. App-ID
App-ID
Which type of Next Generation Firewall decryption inspects SSL traffic coming from external users to internal servers?
Select one:
a. SSL Inbound Inspection
b. SSL Forward Proxy
c. SSH
d. SSL Outbound Inspection
SSL Inbound Inspection
True or False. In the Next Generation Firewall, even if the Decryption policy rule action is “no-decrypt,” the Decryption Profile attached to the rule can still be configured to block sessions with expired or untrusted certificates.
Select one:
True
False
True
Which two types of activities does SSL/TLS decryption on the firewall help to block?
Choose the 2 correct choices.
If you choose an incorrect choice your question score will be deducted
Select one or more:
a.
sensitive data exfiltration
b.
malware introduction
c.
protocol-based attacks
d.
denial-or-service attacks
sensitive data exfiltration
malware introduction
True or false? If OCSP and CRL are configured on a firewall, CRL is consulted first.
Select one:
True
False
False
Which type of firewall decryption requires the administrator to import a server certificate and a private key into the firewall?
Select one:
a.
SSH Decryption
b.
SSL Inbound Inspection Decryption
c.
SSL Forward Proxy Decryption
d.
SSH Tunnel Decryption
SSL Inbound Inspection Decryption
True or false? The SSL forward untrusted certificate should not be trusted by the client but should still be a CA certificate.
Select one:
True
False
True
True or false? The firewall still can check for expired or untrusted certificates even if the SSL traffic is not being decrypted.
Select one:
True
False
True
