Exam SY0-501 topic 1 question 747 discussion

One thing I find with these questions. When in doubt, choose 'A' if you need to go by luck. Most of the time I see 'A' pop up for stuff I don't know.

A is correct... In this the administrator of the system built the new UTM capable of reviewing the SSL / TLS flow for the suspicious payloads it see that the both inbound traffic flow originating from both the web and stopping on protected application server of the business .The full CA certificate sequence of web servers should be built on a UTM configuration will solve the problem .

I would say A since if the full certificate chain is installed on the UTM the UTM can decrypt, inspect then repackage, encrypt and send it along. The other answer like C. only talks about the private certificate being installed on the UTM. Option D where the CA has nothing to do with this process won't be the answer.

In public-key cryptography the traffic is encrypted using a public key and traffic is decrypted using private key. If the UTM needs to decrypt the traffic destined to the web server - It needs the web servers "PRIVATE KEY". I have experience working with reverse proxies and decryption/SSL offloading which is very similar to what is being attempted using UTM. Answer should be D.

As far as I know, the full chain needs to be on servers to make sure they are trusted and valid. If the proper certificates or chain is not established, connections to these servers will be not be trusted. SSL inspection requires a proxy or device to intercept and inspect traffic. (This is like a man in the middle attack, but for a positive use). The proxy DECRYPTS the SSL session, scans the content, and then repackages the SSL session and sends the transmission via an SSL tunnel.

Although none of the answers seemed right to me i am going with D according to this article: https://www.fastvue.co/sophos/blog/how-https-ssl-inspection-affects-logging-and-reporting-in-sophos-utm/ At "Deploying SSL Inspection with Sophos UTM" section it says that the UTM's certificate downloaded via device's admin interface must be both on the device and the Windows machine so that Windows machine can then trust any connection signed by your UTM.

A makes no sense, how is the UTM going to deycrypt the payload and inspect it unless it has the private certificate from the webserver. I am going with C.