PCNSA Decryption and Monitoring — 10 Questions

Question 1

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.. Option C is correct because setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

Answer

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Answer

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Answer

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

Question 2

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

Accepted Answer

The firewall's CA certificate is not installed in the trusted root store on user endpoints.. Option C is correct because SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

Answer

The decryption policy uses 'No Decrypt' for the internal application's URL category.

Answer

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

Answer

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

Question 3

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

Accepted Answer

Tunnel Inspection logs. Tunnel Inspection logs are specifically designed to record traffic that bypasses decryption due to a 'No Decrypt' policy rule. When a decryption policy is set to 'No Decrypt', the firewall does not inspect the encrypted payload, but Tunnel Inspection logs capture metadata about the bypassed session, including the reason for bypass. This allows administrators to monitor and audit traffic that was not decrypted, ensuring visibility into policy exceptions.

Answer

URL Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 4

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 5

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Accepted Answer

Dashboard. The Dashboard in Palo Alto Networks firewall provides real-time visibility into decryption statistics, including the number of sessions decrypted, certificate errors, and decryption failures. This is accessible via the 'Decryption' widget on the Dashboard, which aggregates live data from the decryption engine without requiring log queries or report generation.

Answer

Policy Optimizer

Answer

Log Viewer

Answer

Reports

Question 6

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Question 7

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Accepted Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'alert'.. Option A is correct because the firewall can decrypt TLS 1.0 traffic (action 'Decrypt') while using the 'TLS Version Check' feature set to 'alert' to detect and log the deprecated protocol without disrupting the connection. This allows the administrator to identify hosts using TLS 1.0 for reporting and remediation, while maintaining business continuity.

Answer

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Answer

Use a Security policy rule to block TLS 1.0 traffic.

Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Question 8

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Accepted Answer

Users receive certificate warnings when accessing HTTPS sites.. When the firewall's SSL Forward Proxy decryption certificate expires, the firewall can no longer present a valid certificate to clients during the SSL/TLS handshake. Browsers and applications will detect the expired certificate and display certificate warnings or errors to users, but the firewall may still attempt to decrypt traffic using the expired certificate, causing trust failures. This is the immediate impact because the firewall does not block traffic by default; it continues to proxy the connection, but the client rejects the invalid certificate.

Answer

The firewall logs a critical system alert.

Answer

Decryption stops working and all SSL traffic is blocked.

Answer

The firewall automatically renews the certificate from the CA.

Question 9

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Exclude traffic to financial and healthcare sites from decryption.. Options B and D are correct. Option A is wrong because CA-signed certs are recommended for trust. Option C is wrong because decrypting internal traffic can cause issues; best practice is to exclude internal traffic. Option E is wrong because decrypting all traffic is not recommended; use selective decryption.

Answer

Use a self-signed certificate for decryption.

Answer

Decrypt all internal traffic including server-to-server.

Answer

Decrypt all outbound traffic regardless of destination.

Question 10

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. Option A is correct because 'No Decrypt' is a valid action in a decryption policy rule that explicitly excludes traffic from decryption, often used for traffic that cannot be decrypted (e.g., certificate pinning) or should not be inspected for compliance reasons. This action ensures the firewall forwards the traffic without attempting SSL/TLS interception.

Answer

Block

Answer

Forward