Exam CAS-004 topic 1 question 227 discussion

D. SSL/TLS decryption is the best solution to ensure the administrator can complete the assigned task. This is because SSL/TLS encryption is commonly used to protect sensitive information in transit, including login credentials and other personal or confidential data. However, it can also be used to hide malicious traffic from network security devices such as firewalls. By decrypting SSL/TLS traffic, the firewall administrator can inspect all traffic across the network, including any potentially malicious content. Option A, a full-tunnel VPN, would allow for secure remote access to the company network, but it would not necessarily ensure all traffic across the network is inspected. Option B, web content filtering, would restrict access to certain websites, but it would not necessarily ensure all traffic across the network is inspected. Option C, an endpoint DLP (Data Loss Prevention) solution, would protect against the unauthorized transmission of sensitive data, but it would not necessarily ensure all traffic across the network is inspected.

Ans D. Reasons. Full-Tunnel VPN is focused on providing secure and private access to a network for remote users by encrypting all their traffic and routing it through a VPN server. SSL/TLS Decryption is focused on inspecting encrypted traffic to ensure it is safe and does not contain malicious content or violate security policies. Choosing between these two depends on your specific needs: If you need secure remote access to a network, a full-tunnel VPN is appropriate. If you need to inspect and analyze encrypted traffic for security threats, SSL/TLS decryption is the solution.

D. agree with all the positive comments.

I chose D bot C, based on my previous comment

The best solution to ensure all traffic across the company network is inspected is SSL/TLS decryption. This is because SSL/TLS encryption can hide malicious traffic from firewalls and other security measures. By decrypting SSL/TLS traffic, the firewall administrator can inspect all traffic passing through the network, including encrypted traffic. This can help to detect and prevent security threats such as malware, phishing attacks, and data exfiltration.

Most traffic comes from 443 so TLS/SSL with the keyword INSPECTION