A NOC engineer proposes turning off SSL inspection entirely for the whole corporate segment just to stop certificate warnings on the OT vendor's pinned application, instead of adding that one application to the SSL exemption list. What is the main drawback of the engineer's proposed approach?

Disabling SSL inspection for an entire firewall policy removes decryption — and therefore web filtering, antivirus, and any other content-level visibility — from every session that policy covers, not just the one pinned OT application causing trouble. Since only that single application actually breaks under decryption, the broad disable trades away protection for the whole corporate segment to solve a narrowly scoped problem, which is a poor cost-benefit trade compared to a targeted SSL exemption for just that server or FQDN. The throughput argument is a real but secondary side effect; the meaningful drawback is the security visibility lost across every other flow on that segment, which the exemption-list approach avoids entirely by leaving inspection active everywhere except the specific exempted destination. SSL inspection settings do apply at the policy or profile level and absolutely can be turned off there, so the claim that policy-level changes have no effect is incorrect. Disabling SSL inspection also has no relationship to Layer 3 routing between zones; routing and content inspection are independent functions, so nothing about routing would break as a side effect. As a check, compare web-filter and antivirus log volume for the segment before and after the proposed change to see the visibility gap the broad disable would create.