Company privacy policy forbids inspecting the content of employees' sessions to banking and healthcare websites, but all other HTTPS traffic must remain decrypted for malware and DLP inspection. What is the appropriate configuration?
Select an answer to reveal the explanation.
Short Explanation
You don't take the locks off the whole building because a couple of rooms are private. Leave decryption on and carve out do-not-decrypt exceptions for banking and health. The trap is DLP in monitor mode — monitoring still means reading the content, which is what the policy forbids.
Full Explanation
Selective decryption lets an organization inspect most HTTPS traffic while exempting categories or destinations where inspection is inappropriate for privacy, legal or technical reasons. In Cisco Secure Access, decryption is enabled for web traffic and do-not-decrypt exceptions are defined for specific categories or destination lists, so sessions to financial and health sites pass through without being decrypted, while other HTTPS traffic continues to receive full URL filtering, file inspection and DLP. That satisfies both halves of the requirement. Turning decryption off globally meets the privacy rule but abandons malware and DLP inspection of all other HTTPS traffic, violating the second requirement. Blocking the banking and healthcare categories is not a privacy measure; it prevents employees from legitimately using those services and changes the business policy instead of the inspection policy. Allowing those categories with DLP in monitor mode still decrypts and examines the session content, which is exactly what the privacy policy forbids; monitor only changes the action, not the inspection. Exam caveat: undecrypted sessions still receive DNS and SNI-based category enforcement, so threat categories can still be blocked without seeing content. Operational check: browse to a banking site and confirm its certificate is the bank's original, then browse to a general site and confirm the certificate chains to the Secure Access root.