The correct answer is B. Outbound HTTPS Inspection works by placing the Security Gateway logically between the internal client and the external HTTPS server. The gateway intercepts the TLS connection, presents a certificate to the client on behalf of the requested site, decrypts the traffic for inspection by supported blades, and then creates a separate encrypted TLS connection from the gateway to the real external server. This is a controlled man-in-the-middle inspection model using a trusted outbound CA certificate. Option A is wrong because the gateway does not simply ''monitor'' the original negotiation and collect keys; modern TLS is specifically designed to prevent passive key collection. Option C is technically false because users do not insert a static key into browsers for all HTTPS sessions. Option D is fiction; HTTPS Inspection does not rely on JavaScript payloads or browser helper modules to steal or share encryption keys. The operational requirement is correct CA deployment to client trust stores so the gateway-generated certificates are trusted. Reference topics: HTTPS Inspection, outbound CA certificate, TLS interception, supported Software Blades.