Yeah, D is right for this. The firewall basically sits as MITM using the internal server's private key on inbound SSL, that's the whole point of inbound inspection. If it was asking about outbound inspection to external sites then C might be correct. Correct me if I missed something!

I thought A at first since the firewall just sits between client and server, kind of transparent. But now I'm thinking that's only if it's not actually doing decryption. SSL Inbound Inspection should make it act more like a MITM, but I could see why someone picks A if they focus on "transparently". Anyone else see it that way?

D imo. SSL Inbound Inspection makes the firewall act as a MITM because it needs the server's private key to actually decrypt traffic going to the internal server. If the cert/private key isn't available, then A would make more sense since it can't inspect anything. Pretty sure D is what exam reports expect though, anybody disagree?