PCNSA Practice Test 8 — 10 Questions

Question 1

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Accepted Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'alert'.. Option A is correct because the firewall can decrypt TLS 1.0 traffic (action 'Decrypt') while using the 'TLS Version Check' feature set to 'alert' to detect and log the deprecated protocol without disrupting the connection. This allows the administrator to identify hosts using TLS 1.0 for reporting and remediation, while maintaining business continuity.

Answer

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Answer

Use a Security policy rule to block TLS 1.0 traffic.

Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Question 2

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

Accepted Answer

There are a few sessions failing due to TLS version mismatch.. The exhibit shows decryption sessions with a 'TLS version mismatch' error, which indicates that the firewall is failing to establish a decryption session because the client and server are attempting to use different TLS versions (e.g., TLS 1.0 vs. TLS 1.2). This is a specific failure reason logged in the decryption session table, and the large number of such sessions confirms that many are failing due to this mismatch, not due to certificate errors or policy issues.

Answer

The firewall is rejecting many sessions due to certificate errors.

Answer

The decryption policy is not being hit because of low policy hits.

Answer

The current decryption session count is at its peak.

Question 3

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

Accepted Answer

No Decrypt (bypass decryption). The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.

Answer

Error due to rule conflict

Answer

Block

Answer

Decrypt

Question 4

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 5

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.. Option C is correct because setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

Answer

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Answer

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Answer

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

Question 6

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Question 7

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

Accepted Answer

Tunnel Inspection logs. Tunnel Inspection logs are specifically designed to record traffic that bypasses decryption due to a 'No Decrypt' policy rule. When a decryption policy is set to 'No Decrypt', the firewall does not inspect the encrypted payload, but Tunnel Inspection logs capture metadata about the bypassed session, including the reason for bypass. This allows administrators to monitor and audit traffic that was not decrypted, ensuring visibility into policy exceptions.

Answer

URL Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 8

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Accepted Answer

Users receive certificate warnings when accessing HTTPS sites.. When the firewall's SSL Forward Proxy decryption certificate expires, the firewall can no longer present a valid certificate to clients during the SSL/TLS handshake. Browsers and applications will detect the expired certificate and display certificate warnings or errors to users, but the firewall may still attempt to decrypt traffic using the expired certificate, causing trust failures. This is the immediate impact because the firewall does not block traffic by default; it continues to proxy the connection, but the client rejects the invalid certificate.

Answer

The firewall logs a critical system alert.

Answer

Decryption stops working and all SSL traffic is blocked.

Answer

The firewall automatically renews the certificate from the CA.

Question 9

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. Option A is correct because 'No Decrypt' is a valid action in a decryption policy rule that explicitly excludes traffic from decryption, often used for traffic that cannot be decrypted (e.g., certificate pinning) or should not be inspected for compliance reasons. This action ensures the firewall forwards the traffic without attempting SSL/TLS interception.

Answer

Block

Answer

Forward

Question 10

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

SSL Forward Proxy. SSL Forward Proxy is correct because it allows the firewall to decrypt outbound SSL/TLS traffic from internal clients to external servers, enabling inspection of encrypted content for threats and data filtering. This is a core decryption feature in Palo Alto Networks firewalls, distinct from inbound inspection.

Answer

SSH Proxy

Answer

TLS 1.3 Decryption

Answer

SSL Reverse Proxy