A manufacturing firm's policy requires TLS inspection of employee web traffic so IPS and file policies can see inside sessions, while sites that pin certificates, such as corporate banking and government portals, must pass through untouched. The CISO also insists that any session the firewall cannot decrypt is blocked rather than allowed onward. Which SSL decryption policy design should the engineer apply?
Select an answer to reveal the explanation.
Short Explanation
Put the pinned-site bypass before your employee HTTPS decryption rule, like an express lane for sites that can’t tolerate inspection. Set failed decryption to block, so traffic the firewall can’t inspect never slips through.
Full Explanation
SSL decryption rules are evaluated from the top down, so the working design puts the do-not-decrypt rule for pinned banking and government sites above the decrypt rule for employee web traffic, keeping those sessions tunneled untouched while the rule below hands matching traffic to the configured trusted certificate authority for interception and inspection. The failure action is a separate decision: blocking on a failed decryption ends the session rather than quietly falling back to tunneling. Decrypting everything in a single rule with no bypass preserves inspection but breaks the pinned applications, which is exactly why the exemption must sit above it. Tunneling whenever decryption fails satisfies the exemption and the inspection rule yet still misses the fail-closed requirement, leaving a blind spot an attacker can trigger deliberately. Do-not-decrypt rules only keep every application working but produce no inspection at all, missing the core requirement. Exam caveat: a decrypt rule that is too broad also captures traffic to trusted internal endpoints where interception brings no value. Practical check: visit a pinned banking site, then confirm in connection events that an undecryptable session is blocked.