Broadcom Secure Sockets Layer Visibility Technical Specialist (250-444) Certification Sample Questions

01. A flight school has moved decryption off its ProxySG and onto an SSL Visibility appliance, which now hands the proxy the plaintext of the sessions policy opens. The head of training asks that a category of external sites be denied to student accounts, with the school's acceptable-use notice returned to the student when it happens.
Where does that change belong?
a) In the appliance's decryption policy, since the sessions it does not open are the ones students would use to reach the category
b) In the appliance's exemption list, by removing the category from it
c) In the internal authority's issuing rules, so that certificates are withheld for that category
d) In the proxy's web policy, since that is where per-user rules and the notice belong

02. A university has finished an SSL Visibility upgrade and returned the appliance to the path late in the evening. Traffic is flowing, the attached tools are receiving plaintext, and the engineer would like to close the change record straight away.
Why does the plan keep a monitoring period open after service is restored?
a) Some effects appear only under the traffic volumes and session mixes of a normal working day
b) The monitoring period is where the backup taken before the change is verified, which cannot be done while the appliance is out of the path
c) Keeping the record open preserves the vendor's obligation to assist should a fault be reported later
d) It allows the appliance to finish applying the new configuration

03. One link at a book publisher's head office carries two very different kinds of traffic: staff personal browsing during breaks, and the transfer of authors' unpublished manuscripts to an external editing house. The security lead proposes a single decryption rule covering everything on that link.
What is the flaw in governing the whole link with one rule?
a) A single rule cannot be applied to a link that carries more than one type of traffic, and the appliance will refuse to load it.
b) The two kinds of traffic carry different obligations on the same link.
c) Personal browsing must be decrypted in full, and only the manuscript transfers may be exempted.
d) Encryption is a property of the link, so no per-session distinction can be drawn.

04. A hospital inspects two links with an SSL Visibility appliance. One carries clinical staff traffic that falls under patient-privacy obligations; the other carries traffic from the public guest wireless network in the outpatient building. Security wants broad decryption of guest traffic, with a set of clinical categories left encrypted.
The clinical exemptions and the broad decryption rule are being written into one ordered rule set. What determines whether the exemptions take effect?
a) Their specificity, since a narrowly written rule is preferred over a broad one wherever both could describe the same session
b) The obligation behind them, since rules that carry a privacy duty are evaluated ahead of rules written for general use
c) Their position, since the first rule a session matches settles it
d) Nothing beyond their presence, since every rule is checked against each session and an exemption anywhere in the set prevents decryption

05. A port authority exempts online banking destinations from decryption in its policy. An analyst joining the team asks what that exemption means for the authority's inspection coverage.
What is the security consequence of exempting those destinations?
a) Sessions to those sites are inspected by the proxy instead.
b) Sessions to those sites are decrypted and inspected, then discarded without being written to any tool's storage.
c) Sessions to those sites are rejected at the appliance rather than forwarded to the destination.
d) Sessions to those sites pass through still encrypted, a gap knowingly accepted.

06. A weather forecasting service used to administer each appliance directly, with engineers signing in to whichever one needed a change. It has since moved to central administration. Reviewing a decryption change that should not have been made, the service wants to establish how that change came about.
What does central administration provide that the previous arrangement did not?
a) A copy of the traffic that was decrypted while the change was in force, held centrally for review
b) One record of which change was made, by whom and when
c) A guarantee that a change of that kind cannot be written, approved, or distributed at all
d) An automatic reversal of any change the review finds should not have been made

07. A software vendor runs its virtual SSL Visibility appliance on a hypervisor host it shares with several build servers. During nightly build runs, users report that connections crossing the inspection point are noticeably slower. No policy, interface or attachment configuration has been changed.
What is the most likely explanation?
a) The appliance has begun re-signing certificates for sessions that policy previously exempted, which lengthens every handshake it processes.
b) The attached security tools have fallen behind and are applying back pressure to the appliance across the inspection path.
c) The build servers are competing with the appliance for host resources.
d) The build traffic is being decrypted on entry and then decrypted a second time on exit.

08. An e-commerce platform has enabled inbound inspection of the traffic arriving at its checkout service, and plaintext is now available for security tools to be attached to.
Which two tools are the natural consumers of that plaintext?
(Choose two.)
a) A web application firewall examining the requests reaching the checkout application
b) A certificate lifecycle manager tracking the expiry dates of the checkout service's published certificates
c) A load balancer distributing sessions across the checkout servers
d) A data loss prevention system inspecting the responses

09. An engineering consultancy finds that its web filtering reports name the sites staff reach but say nothing about what is done at them, and that prohibited material is moving through services the acceptable-use policy otherwise allows.
How does encrypted traffic management address this?
a) It replaces the filtering system's rules with the appliance's own decryption policy, which is evaluated against every session before it is forwarded.
b) It restores readable session content, so the filtering system can see which resource is requested beneath the host name.
c) It blocks encrypted sessions whose contents cannot be accounted for from the reports.
d) It removes the encryption from the sessions so that no policy is required.

10. A managed service provider hosts several customer web services reachable through a single external address. Each service has its own certificate, and a copy of each service's private key has been loaded onto the SSL Visibility appliance. A new session arrives and the appliance has to choose which of the loaded keys applies to it.
What determines the key it selects?
a) The host name the client offers when it opens the handshake
b) The source address of the client, matched against the customer address ranges recorded when each key was loaded
c) The order in which the keys were loaded, each being tried in turn until one produces readable plaintext
d) The certificate the server returns, which the appliance reads before making its selection