A hospital system must inspect decrypted web traffic for malware and intrusions across its business subnets, while personal banking and healthcare portal sessions stay encrypted and remain fully reachable for staff. The decryption policy is new, and the team wants one ordered rule set the Management Center evaluates predictably. Which decryption policy design satisfies these requirements?
Select an answer to reveal the explanation.
Short Explanation
You keep banking and healthcare sessions encrypted and reachable by placing their Do not decrypt rules above the general decrypt rule; ordering determines which matching rule handles each session. The general decrypt rule placed first would expose those sessions, while omitting intrusion and file policies or limiting decryption to standard ports would leave some traffic uninspected.
Full Explanation
The design that places banking and healthcare category Do not decrypt rules above the general decrypt rule preserves those sessions as encrypted and reachable. In an ordered decryption policy, the earlier matching rule determines how a session is handled, so other matching business web sessions are decrypted for inspection. The access control rules must also reference intrusion and file policies (Secure Malware Defense) for inspection; decryption alone does not inspect traffic, and Threat Defense has no separate data loss prevention engine. Putting the general decrypt rule above the category exceptions means its broad match can take effect first, preventing the intended privacy carve-out and potentially decrypting those personal sessions. Decrypting remaining business web sessions without attaching intrusion or file policies leaves decrypted traffic uninspected, so it does not meet the inspection requirement. Restricting decryption to standard ports leaves business web sessions on nonstandard ports subject to the policy’s Do not decrypt default action, creating an inspection gap. Exam caveat: category matching depends on URL categorization and session visibility; an uncategorized or newly classified portal may not match the intended bypass without suitable handling. Practical check: review rule order, match counters, category results, and intrusion and file events, then test representative banking, healthcare, and business web sessions, including approved nonstandard-port services, to confirm encryption, reachability, and inspection behavior.