Which capability lets an organization inspect TLS/SSL traffic by acting as a MitM?

• A. Break and Inspect (TLS/SSL Inspection)
• B. ACL-Based Traffic Mirroring
• C. Network Management Station
• D. SNMP

Answer: (A)

TLS/SSL inspection is the capability that lets an organization inspect encrypted traffic by acting as a man-in-the-middle. In practice, a security appliance such as a next‑generation firewall or secure web gateway terminates the client’s TLS session, decrypts the traffic to inspect it for threats or policy violations, and then re-encrypts it for delivery to the server. This provides visibility into content that would otherwise remain hidden behind encryption, enabling malware scanning, data loss prevention, and access control decisions.

For this to work, endpoints must trust the appliance’s certificate authority; otherwise users will see certificate warnings. It also comes with tradeoffs—there’s performance overhead, privacy considerations, and some traffic can’t be decrypted (for example, if the application uses certificate pinning or strict TLS configurations).

The other options describe different concepts: duplicating traffic for monitoring without decrypting it, or management functions that don’t involve inspecting content inside TLS/SSL sessions.