A network security engineer wants to prevent resource-consumption issues on the firewall. Which strategy is consistent with decryption best practices to ensure consistent performance?
A.
Use Decryption profiles to downgrade processor-intensive ciphers to ciphers that are less processor-intensive
B.
Use Decryption profiles to drop traffic that uses processor-intensive ciphers
C.
Use PFS in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic
D.
Use RSA in a Decryption profile for higher-priority and higher-risk traffic, and use less processor-intensive decryption methods for lower-risk traffic
Answer is C. If firewall resources are an issue, use stronger decryption for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect lower-priority traffic until you can increase the available resources.
Option A involves optimizing the decryption process by using less processor-intensive ciphers for traffic that doesn't require the highest level of security. This allows you to strike a balance between security and performance, ensuring that your firewall can handle the decryption workload efficiently without compromising security.
Definitely C
A and B are not relevant
As per the link and the text below
Use RSA for traffic that isnt sensitive ( so D is wrong because you would use RSA for low risk /non sensitive traffic and not higher-priority and higher-risk traffic as in option D )
Which leaves C as the most correct
The performance cost of PFS trades off against the higher security that PFS achieves, but PFS may not be needed for all types of traffic.
You can save firewall CPU cycles by using RSA for traffic that you want to decrypt and inspect for threats but that isn’t sensitive.
If firewall resources are an issue, use stronger decryption (such as PFS) for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect
lower-priority traffic until you can increase the available resources.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/prepare-to-deploy-decryption/size-the-decryption-firewall-deployment
The correct answer is D.
he combination of these factors determines how decryption consumes firewall processing resources. To best utilize the firewall’s resources, understand the risks of the data you’re protecting. If firewall resources are an issue, use stronger decryption for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect lower-priority traffic until you can increase the available resources. For example, you could use RSA instead of ECDHE and ECDSA for traffic that isn’t sensitive or high-priority to preserve firewall resources for using PFS-based decryption for higher priority, sensitive traffic. (You’re still decrypting and inspecting the lower-priority traffic, but trading off consuming fewer computational resources with using algorithms that aren’t as secure as PFS.) The key is to understand the risks of different traffic types and treat them accordingly.
Option C
If firewall resources are an issue, use stronger decryption for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect lower-priority traffic until you can increase the available resources
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/prepare-to-deploy-decryption/size-the-decryption-firewall-deployment
C
"For example, you could use RSA instead of ECDHE and ECDSA for traffic that isn’t sensitive or high-priority to preserve firewall resources for using PFS-based decryption for higher priority, sensitive traffic. (You’re still decrypting and inspecting the lower-priority traffic, but trading off consuming fewer computational resources with using algorithms that aren’t as secure as PFS.) "
f firewall resources are an issue, use stronger decryption for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect lower-priority traffic until you can increase the available resources. For example, you could use RSA instead of ECDHE and ECDSA for traffic that isn’t sensitive or high-priority to preserve firewall resources for using PFS-based decryption for higher priority, sensitive traffic.
Yes so the answer is C
less processor-intensive decryption methods for lower-risk traffic = RSA
upvoted 2 times
...
...
This section is not available anymore. Please use the main Exam Page.PCNSE Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
kambata
Highly Voted 2Â years, 2Â months agoWhizdhum
Most Recent 10Â months, 3Â weeks agoNawda
1Â year, 1Â month agoelectro165
1Â year, 2Â months agoRowdy_47
1Â year, 8Â months agoPaloGuy
1Â year, 10Â months agoSarbi
1Â year, 10Â months agoawtsuritacuna
1Â year, 11Â months agoconfusion
2Â years agoTAKUM1y
2Â years agoGabuu
2Â years agomizuno92
2Â years, 1Â month agoDrNick0
2Â years, 1Â month agomillosz222
2Â years, 1Â month agonose999
2Â years, 1Â month ago