300-415 Question 231
Select 2An enterprise has deployed Cisco SD-WAN across its branch offices and wants to enable SSL/TLS proxy to inspect encrypted traffic for potential threats. While configuring this feature, the IT team needs to ensure proper functionality and compliance with security policies. Which of the following steps are required to successfully configure SSL/TLS proxy on the SD-WAN solution?
- A
Deploy certificates on vEdge devices to enable traffic decryption and re-encryption.
- B
Configure an Application-Aware Routing policy to redirect encrypted traffic to a data center for inspection.
- C
Enable DPI (Deep Packet Inspection) on vEdge devices to identify SSL/TLS flows.
- D
Configure a centralized policy to define which traffic is allowed to be decrypted.
- E
Install a root certificate from a trusted Certificate Authority on endpoints.
Show answer and explanation
Correct answers: A, D
Explanation
To configure SSL/TLS proxy on Cisco SD-WAN, it is essential to deploy certificates on vEdge devices for proper decryption and re-encryption of traffic, ensuring secure handling of SSL/TLS flows. Additionally, a centralized policy is required to define the scope of decryption, ensuring compliance with security policies. Other options, such as Application-Aware Routing or endpoint-specific configurations, are not directly relevant to this feature.
- A. Correct.
Correct. SSL/TLS proxy functionality requires valid certificates to decrypt and re-encrypt traffic securely at the vEdge devices.
- B. Incorrect.
Incorrect. Application-Aware Routing is not used to redirect traffic for SSL/TLS decryption; SSL/TLS proxy is handled directly on the devices configured for this purpose.
- C. Incorrect.
Incorrect. While DPI can identify SSL/TLS flows, it is not specifically required for configuring the SSL/TLS proxy feature.
- D. Correct.
Correct. A centralized policy is necessary to define the traffic that can be decrypted, ensuring compliance and proper segmentation.
- E. Incorrect.
Incorrect. Installing a root certificate on endpoints is not directly related to the SSL/TLS proxy configuration on Cisco SD-WAN devices but is more relevant for endpoint-specific configurations.