IBM Security Network Protection (XGS) V5.3.2 System Administration

One XGS appliance in a financial company was running firmware version 5.2 for 2 years. The System Administrator upgraded the firmware to 5.3.2.3 because version 5.2 is no longer supported and enabled Any-Any-Any-Inspect rule in Outbound SSL Inspection Policy according to new company audit policy. After that, several users complain that their workstations cannot get Windows Update any more. What should the System Administrator do to resolve this issue?

The System Administrator has configured Outbound SSL Inspection Policy for five SSL-enabled web sites. How can the SSL decryption errors for each web site be detected?

A System Administrator is planning to implement SSL Inspection for both outbound user traffic and inbound traffic to a company web server. The requirements are as follows: SSL Inspection should protect users from connections to fraudulent servers

• Outbound SSL Inspection should be limited to select web site categories
• Avoid having to deploy files, configurations, or certificates to user workstations
• The steps to implement this plan are as follows:

 Obtain an Inspection license for the XGS

• Obtain a certificate from a public CA and upload it to the XGS via Outbound SSL Certificates
• Obtain the certificate and private key of the internal web server and upload it to the XGS via Inbound SSL Certificates
• Add internal CA certificates for the company intranet to the trusted Certificate Authorities tab in Outbound SSL Inspection Settings
• Configure Outbound SSL Inspection Settings to block connections if the server certificate is self-signed or invalid
• Create Outbound SSL Inspection rules that inspect only specific Domain Certificate Categories
• Create Inbound SSL Inspection rules that only decrypt traffic destined for the internal web server II address
• What will happen if an internal user attempts to access the company intranet?

A System Administrator wants to install the XGS license files during the first time configuration of the appliance. How should the first time configuration wizard on the appliance be accessed?

A System Administrator sees a lot of Ping_Sweep events reported as blocked on the network. However, because the Ping_Sweep signature only blocks the ping packet that triggers the event, most of the ping packets are allowed through the XGS. How can these suspicious packets be effectively blocked from the network?

Security Policies of an organization demand that no network traffic should be allowed by XGS without inspection in case of XGS power failure or traffic beyond XGS  capabilities. What should be the settings for built-in Hardware Bypass and Unanalyzed Policy?

A System Administrator wants to configure an XGS to send all IPS security event alerts to a remote system using Syslog. How should the System Administrator configure the XGS?

The System Administrator has configured the Advanced Tuning Parameter alpsd.ssl.inverse=1 (Man-in-the-Middle (MitM) approach) to allow Diffie-Hellman key exchange usage so traffic to their internal web portal can be decrypted. Which additional steps need to be taken to configure the XGS?

A System Administrator discovered the XGS appliance is unstable after upgrading firmware to the newest version. How should the device be restored to the previous stable state?

A System Administrator has an XGS 4100 appliance that has a single 8-port RJ-45 copper Network Interface Module (NIM) installed. What is the maximum number of in-line network segments, of any media type, that could be protected?