PCNSA Decryption and Monitoring — 30 Questions

Question 1

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.. Option C is correct because setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

Answer

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Answer

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Answer

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

Question 2

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

Accepted Answer

The firewall's CA certificate is not installed in the trusted root store on user endpoints.. Option C is correct because SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

Answer

The decryption policy uses 'No Decrypt' for the internal application's URL category.

Answer

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

Answer

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

Question 3

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

Accepted Answer

Tunnel Inspection logs. Tunnel Inspection logs are specifically designed to record traffic that bypasses decryption due to a 'No Decrypt' policy rule. When a decryption policy is set to 'No Decrypt', the firewall does not inspect the encrypted payload, but Tunnel Inspection logs capture metadata about the bypassed session, including the reason for bypass. This allows administrators to monitor and audit traffic that was not decrypted, ensuring visibility into policy exceptions.

Answer

URL Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 4

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 5

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Accepted Answer

Dashboard. The Dashboard in Palo Alto Networks firewall provides real-time visibility into decryption statistics, including the number of sessions decrypted, certificate errors, and decryption failures. This is accessible via the 'Decryption' widget on the Dashboard, which aggregates live data from the decryption engine without requiring log queries or report generation.

Answer

Policy Optimizer

Answer

Log Viewer

Answer

Reports

Question 6

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Question 7

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Accepted Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'alert'.. Option A is correct because the firewall can decrypt TLS 1.0 traffic (action 'Decrypt') while using the 'TLS Version Check' feature set to 'alert' to detect and log the deprecated protocol without disrupting the connection. This allows the administrator to identify hosts using TLS 1.0 for reporting and remediation, while maintaining business continuity.

Answer

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Answer

Use a Security policy rule to block TLS 1.0 traffic.

Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Question 8

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Accepted Answer

Users receive certificate warnings when accessing HTTPS sites.. When the firewall's SSL Forward Proxy decryption certificate expires, the firewall can no longer present a valid certificate to clients during the SSL/TLS handshake. Browsers and applications will detect the expired certificate and display certificate warnings or errors to users, but the firewall may still attempt to decrypt traffic using the expired certificate, causing trust failures. This is the immediate impact because the firewall does not block traffic by default; it continues to proxy the connection, but the client rejects the invalid certificate.

Answer

The firewall logs a critical system alert.

Answer

Decryption stops working and all SSL traffic is blocked.

Answer

The firewall automatically renews the certificate from the CA.

Question 9

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Exclude traffic to financial and healthcare sites from decryption.. Options B and D are correct. Option A is wrong because CA-signed certs are recommended for trust. Option C is wrong because decrypting internal traffic can cause issues; best practice is to exclude internal traffic. Option E is wrong because decrypting all traffic is not recommended; use selective decryption.

Answer

Use a self-signed certificate for decryption.

Answer

Decrypt all internal traffic including server-to-server.

Answer

Decrypt all outbound traffic regardless of destination.

Question 10

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. Option A is correct because 'No Decrypt' is a valid action in a decryption policy rule that explicitly excludes traffic from decryption, often used for traffic that cannot be decrypted (e.g., certificate pinning) or should not be inspected for compliance reasons. This action ensures the firewall forwards the traffic without attempting SSL/TLS interception.

Answer

Block

Answer

Forward

Question 11

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

SSL Forward Proxy. SSL Forward Proxy is correct because it allows the firewall to decrypt outbound SSL/TLS traffic from internal clients to external servers, enabling inspection of encrypted content for threats and data filtering. This is a core decryption feature in Palo Alto Networks firewalls, distinct from inbound inspection.

Answer

SSH Proxy

Answer

TLS 1.3 Decryption

Answer

SSL Reverse Proxy

Question 12

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

Accepted Answer

There are a few sessions failing due to TLS version mismatch.. The exhibit shows decryption sessions with a 'TLS version mismatch' error, which indicates that the firewall is failing to establish a decryption session because the client and server are attempting to use different TLS versions (e.g., TLS 1.0 vs. TLS 1.2). This is a specific failure reason logged in the decryption session table, and the large number of such sessions confirms that many are failing due to this mismatch, not due to certificate errors or policy issues.

Answer

The firewall is rejecting many sessions due to certificate errors.

Answer

The decryption policy is not being hit because of low policy hits.

Answer

The current decryption session count is at its peak.

Question 13

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

Accepted Answer

No Decrypt (bypass decryption). The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.

Answer

Error due to rule conflict

Answer

Block

Answer

Decrypt

Question 14

A mid-sized enterprise has deployed a Palo Alto Networks firewall with SSL Forward Proxy decryption for outbound traffic. The firewall uses a CA-signed certificate from a public CA, and the certificate is installed on all corporate-managed endpoints. Recently, the security team noticed that a few users are unable to access a specific external SaaS application (app.example.com) over HTTPS. Other users can access it without issues. The firewall logs show that for these users, the session is being decrypted and no threat is detected. The application uses a valid certificate from a public CA. The affected users are in the same IP subnet and use the same browser version. Which is the most likely cause?

Accepted Answer

The firewall's CA certificate is not installed or trusted on the affected users' endpoints.. Option C is correct because SSL Forward Proxy decryption requires the firewall to generate a new certificate on-the-fly for the destination server, signed by the firewall's own CA certificate. If the CA certificate is not trusted on the affected users' endpoints, the browser will display a certificate warning or block the connection entirely, even though the decryption policy is applied and no threats are detected. Since other users in the same subnet can access the application, the issue is isolated to the trust store on the affected machines, not the network or decryption policy.

Answer

The decryption policy is set to 'No Decrypt' for the affected users' source IP range.

Answer

The firewall is performing SSH proxy instead of SSL decryption for those users.

Answer

The SaaS application's certificate has expired for those users due to time zone differences.

Question 15

A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.. Option D is correct because it creates a decryption policy rule with action 'No Decrypt' for the specific URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule. This ensures that traffic to these sensitive categories is excluded from SSL Forward Proxy decryption, resolving the loading issues caused by certificate pinning or regulatory violations, while still decrypting all other student traffic. The rule order is critical because Palo Alto Networks decryption policies are evaluated top-down, and the first match determines the action.

Answer

Modify the existing decrypt rule to decrypt all categories except those two.

Answer

Disable decryption entirely for all student traffic.

Answer

Create a security policy rule to allow traffic to those URL categories without inspection.

Question 16

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Accepted Answer

Inbound Inspection Decryption. Inbound Inspection Decryption is used to decrypt traffic destined to a protected server, such as a web server using HTTPS. In this scenario, the firewall acts as a reverse proxy, intercepting inbound connections to the server and decrypting them for inspection before re-encrypting and forwarding the traffic. This allows the security administrator to inspect the payload of HTTPS traffic without requiring client-side configuration.

Answer

Decryption Mirror

Answer

Outbound (Forward Proxy) Decryption

Answer

SSH Proxy

Question 17

A company wants to decrypt all SSL/TLS traffic from internal users except traffic to financial sites. The firewall is placed as a forward proxy. Which policy configuration ensures that traffic to financial sites is not decrypted?

Accepted Answer

Create a decryption policy with action 'no-decrypt' for traffic to financial sites, and a catch-all decryption policy with action 'decrypt' for all other traffic.. Option D is correct because it uses a specific 'no-decrypt' action in a decryption policy for financial sites, which explicitly excludes them from SSL/TLS decryption. A catch-all policy with 'decrypt' then ensures all other internal user traffic is decrypted. This approach directly aligns with the forward proxy requirement to decrypt all traffic except the specified financial sites.

Answer

Create a decryption policy and use the 'exclude cache' option for financial sites.

Answer

Create a security policy that allows financial sites without decryption; then create a decryption policy with action 'no-decrypt' for those sites.

Answer

Create a decryption policy with action 'decrypt' and a source zone of internal; then create a decryption exemption for financial URLs.

Question 18

During troubleshooting, a firewall shows a large number of SSL decryption failures with error 'certificate_unknown'. The firewall is configured for forward proxy decryption. What is the most likely cause?

Accepted Answer

The firewall cannot reach the CRL or OCSP responder to validate the server certificate.. In forward proxy decryption, the firewall must validate the server certificate against a Certificate Revocation List (CRL) or via OCSP to ensure it hasn't been revoked. A 'certificate_unknown' error specifically indicates that the firewall cannot determine the revocation status of the server certificate, often because it cannot reach the CRL distribution point or OCSP responder. This is distinct from a certificate that is simply expired or untrusted by the client.

Answer

The client does not trust the firewall's CA certificate.

Answer

The server certificate is expired.

Answer

The decryption policy has an incorrect source zone.

Question 19

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 20

A network administrator wants to monitor HTTPS traffic without decrypting it, but still wants to identify the applications being used. Which feature can be used to identify HTTPS applications without decryption?

Accepted Answer

App-ID with SSL protocol detection. App-ID with SSL protocol detection allows the firewall to identify HTTPS applications by inspecting the Server Name Indication (SNI) field in the TLS handshake and the certificate common name, without decrypting the traffic. This enables application identification while preserving encryption, meeting the requirement to monitor HTTPS traffic without decryption.

Answer

SSL Decryption Mirror

Answer

SSL Forward Proxy

Answer

URL Filtering