PCNSA Decryption and Monitoring — All Questions With Answers

Question 1hardmultiple choice

Read the full Decryption and Monitoring explanation →

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

Question 2mediummultiple choice

Read the full Decryption and Monitoring explanation →

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

Question 3easymultiple choice

Read the full Decryption and Monitoring explanation →

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

Question 4hardmultiple choice

Read the full Decryption and Monitoring explanation →

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Question 5easymultiple choice

Read the full Decryption and Monitoring explanation →

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Question 6mediummultiple choice

Read the full Decryption and Monitoring explanation →

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Question 7hardmultiple choice

Read the full Decryption and Monitoring explanation →

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Question 8mediummultiple choice

Read the full Decryption and Monitoring explanation →

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Question 9hardmulti select

Read the full Decryption and Monitoring explanation →

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Question 10mediummulti select

Read the full Decryption and Monitoring explanation →

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Question 11easymulti select

Read the full Decryption and Monitoring explanation →

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Question 12hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

Exhibit

Refer to the exhibit.

# show system info | match decrypt
Decryption status: enabled
Decryption sessions: 523 (current), 1024 (peak)
Certificate errors: 12 (since last hour)

# show decryption statistics
Policy hits: Decrypt: 1500, No Decrypt: 300
TLS version failures: 5 (TLS 1.0: 3, TLS 1.1: 2)

Question 13mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

Exhibit

Refer to the exhibit.

{
  "decryption_rules": [
    {
      "name": "rule1",
      "source_zone": ["trust"],
      "destination_zone": ["untrust"],
      "source_address": ["any"],
      "destination_address": ["any"],
      "category": ["financial-services"],
      "action": "no-decrypt",
      "description": "Skip decryption for finance sites"
    },
    {
      "name": "rule2",
      "source_zone": ["trust"],
      "destination_zone": ["untrust"],
      "source_address": ["any"],
      "destination_address": ["any"],
      "category": ["any"],
      "action": "decrypt",
      "description": "Decrypt all other traffic"
    }
  ]
}

Question 14hardmultiple choice

Review the full subnetting walkthrough →

A mid-sized enterprise has deployed a Palo Alto Networks firewall with SSL Forward Proxy decryption for outbound traffic. The firewall uses a CA-signed certificate from a public CA, and the certificate is installed on all corporate-managed endpoints. Recently, the security team noticed that a few users are unable to access a specific external SaaS application (app.example.com) over HTTPS. Other users can access it without issues. The firewall logs show that for these users, the session is being decrypted and no threat is detected. The application uses a valid certificate from a public CA. The affected users are in the same IP subnet and use the same browser version. Which is the most likely cause?

Question 15mediummultiple choice

Read the full Decryption and Monitoring explanation →

A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?

Question 16easymultiple choice

Read the full Decryption and Monitoring explanation →

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Question 17mediummultiple choice

Read the full Decryption and Monitoring explanation →

A company wants to decrypt all SSL/TLS traffic from internal users except traffic to financial sites. The firewall is placed as a forward proxy. Which policy configuration ensures that traffic to financial sites is not decrypted?

Question 18hardmultiple choice

Read the full Decryption and Monitoring explanation →

During troubleshooting, a firewall shows a large number of SSL decryption failures with error 'certificate_unknown'. The firewall is configured for forward proxy decryption. What is the most likely cause?

Question 19easymultiple choice

Read the full Decryption and Monitoring explanation →

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Question 20mediummultiple choice

Read the full Decryption and Monitoring explanation →

A network administrator wants to monitor HTTPS traffic without decrypting it, but still wants to identify the applications being used. Which feature can be used to identify HTTPS applications without decryption?

Question 21hardmultiple choice

Read the full Decryption and Monitoring explanation →

A firewall administrator notices that traffic from an internal user is being decrypted, but the user's browser shows a certificate warning. The firewall uses a CA certificate issued by the company's internal PKI. What is the most likely reason for the browser warning?

Question 22easymultiple choice

Read the full Decryption and Monitoring explanation →

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

Question 23mediummultiple choice

Read the full Decryption and Monitoring explanation →

A company wants to ensure that decryption policies are applied based on the user identity. The firewall is integrated with Active Directory. Which decryption policy matching criteria should be used?

Question 24hardmultiple choice

Read the full Decryption and Monitoring explanation →

A firewall is experiencing high CPU utilization due to SSL decryption. The administrator wants to reduce the load without completely disabling decryption. Which action should be taken?

Question 25easymulti select

Read the full Decryption and Monitoring explanation →

A security analyst is troubleshooting a decryption issue. Which TWO logs are most useful for identifying decryption failures? (Choose two.)

Question 26mediummulti select

Read the full Decryption and Monitoring explanation →

Which THREE actions can be performed in a decryption policy? (Choose three.)

Question 27hardmulti select

Read the full Decryption and Monitoring explanation →

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Question 28mediummultiple choice

Read the full Decryption and Monitoring explanation →

An administrator runs the command and sees the above output. What is the most likely cause of the large number of handshake failures?

Exhibit

Refer to the exhibit.
```
admin@PA-500> show decryption statistics
Decryption Statistics:
  Total Sessions Decrypted: 1500
  Total Sessions Failed: 50
  Failed Reasons:
    handshake_failure: 30
    certificate_unknown: 15
    decryption_error: 5
```

Question 29hardmultiple choice

Read the full Decryption and Monitoring explanation →

A user at IP 10.0.0.10 is accessing a server at 192.168.1.5. According to the decryption policy, what will happen to the traffic?

Exhibit

Refer to the exhibit.
```
admin@PA-500> show running decryption-policy
Decryption policy:
  #  name              from      to        source        destination    service    action       profile
  1  decrypt-all       trust     untrust   any           any            any        decrypt      default
  2  no-decrypt-fin    trust     untrust   10.0.0.0/24   192.168.1.0/24 any        no-decrypt   none
  3  decrypt-inbound   untrust   trust     any           10.0.0.5/32   https      decrypt      inbound
```

Question 30easymultiple choice

Read the full Decryption and Monitoring explanation →

An administrator sees the above traffic log entries. What can be concluded about the traffic to 192.168.1.1?

Exhibit

Refer to the exhibit.
```
admin@PA-500> show log traffic | match 10.0.0.5
Time          Source       Dest         Application  Action   Decrypted
2023/01/01    10.0.0.5     192.168.1.1  ssl          allow    yes
2023/01/01    10.0.0.5     8.8.8.8      dns          allow    no
```

Question 31easymultiple choice

Read the full Decryption and Monitoring explanation →

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Question 32mediummultiple choice

Read the full Decryption and Monitoring explanation →

An admin notices that decryption is failing for some sites with error 'SSL Handshake Failed' in the traffic log. The decryption policy uses a custom SSL/TLS service profile with 'Allow Self-Signed Certificates' enabled. The firewall's certificate was issued by an internal CA. What should the admin check first?

Question 33hardmultiple choice

Read the full Decryption and Monitoring explanation →

An organization uses inbound inspection decryption for their public-facing web servers. They have imported the server's certificate and private key into the firewall. However, some clients report 'untrusted certificate' warnings. What is the most likely cause?

Question 34easymultiple choice

Read the full Decryption and Monitoring explanation →

A security administrator wants to inspect decrypted traffic for threats. What is the minimum set of features required?

Question 35mediummultiple choice

Read the full Decryption and Monitoring explanation →

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Question 36hardmultiple choice

Read the full Decryption and Monitoring explanation →

A firewall is configured with decryption and a custom SSL/TLS service profile that has 'Block Expired Certificates' enabled. After renewing a server certificate, some users are unable to access the site. The server certificate is correctly installed. What could be the issue?

Question 37easymultiple choice

Read the full Decryption and Monitoring explanation →

An administrator wants to view logs related to decryption failures. Which log type should they use?

Question 38mediummultiple choice

Read the full Decryption and Monitoring explanation →

A decryption policy is configured to decrypt traffic to a specific external server. The admin notices that the traffic is not being decrypted. What is the first step in troubleshooting?

Question 39hardmultiple choice

Read the full Decryption and Monitoring explanation →

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Question 40mediummulti select

Read the full Decryption and Monitoring explanation →

Which TWO actions should be taken when configuring SSL Forward Proxy decryption? (Select exactly two.)

Question 41mediummulti select

Read the full Decryption and Monitoring explanation →

Which THREE factors should be considered when deciding which traffic to decrypt? (Select exactly three.)

Question 42easymulti select

Read the full Decryption and Monitoring explanation →

Which TWO logs are most useful for troubleshooting SSL decryption issues? (Select exactly two.)

Question 43easymultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. The firewall raises a certificate expiry warning for the decryption CA. Which action is required?

Exhibit

> show system info | match cert
cert-management-status: OK
certificate-expiry-warning: cert 'Decrypt-CA' expires in 30 days

Question 44mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A decryption policy has two rules. Traffic destined to a web server is not being decrypted. What is the most likely cause?

Exhibit

> show decryption rule
rule name: Default-No-Decrypt, source: any, dest: any, action: no-decrypt
rule name: Decrypt-Web, source: any, dest: any, action: decrypt, profile: strict

Question 45mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A firewall log shows a decryption failure for a session. What is the most probable cause?

Exhibit

1. 2023/08/15 10:30:45, info, ssl-decrypt, session 12345, Decryption failed: certificate validation error: certificate is not yet valid

Question 46easymultiple choice

Read the full Decryption and Monitoring explanation →

A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?

Question 47mediummultiple choice

Review the full subnetting walkthrough →

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

Question 48hardmultiple choice

Read the full Decryption and Monitoring explanation →

A security team wants to inspect traffic to and from a critical application server. They configure an inbound decryption rule to decrypt traffic destined to the server's IP address. After deploying, they find that traffic is not being decrypted. What is the first step to troubleshoot?

Question 49easymultiple choice

Read the full Decryption and Monitoring explanation →

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Question 50mediummultiple choice

Read the full Decryption and Monitoring explanation →

After enabling SSL decryption, users report that some websites fail to load. The firewall logs show 'decryption error' for these sites. Which decryption profile setting should the administrator check first?

Question 51hardmultiple choice

Read the full Decryption and Monitoring explanation →

An organization is using outbound SSL decryption with a forward proxy. They notice that mobile devices (iOS/Android) are having trouble connecting to many HTTPS sites after decryption is enabled. IT has installed the root CA certificate on all devices. What is the most likely reason?

Question 52easymulti select

Read the full Decryption and Monitoring explanation →

An administrator is troubleshooting decryption-related connectivity issues. Which two log types should be examined to gather information about decryption actions and errors?

Question 53mediummulti select

Read the full Decryption and Monitoring explanation →

During SSL decryption, which three factors can cause the firewall to fail to decrypt a session or to bypass decryption?

Question 54hardmulti select

Read the full Decryption and Monitoring explanation →

A security analyst needs to monitor decryption performance and identify sessions that are bypassing decryption due to policy or technical reasons. Which two monitoring tools or methods can provide this insight?

Question 55mediummultiple choice

Read the full Decryption and Monitoring explanation →

A hospital network uses a Palo Alto Networks firewall with outbound SSL decryption. The IT security team notices that during peak hours, the firewall CPU utilization spikes to 95% when decryption is enabled, causing latency for all users. They have already upgraded to maximum licensed throughput and added a dedicated decryption engine. However, the issue persists. The network has 10,000 endpoints and 500 Mbps throughput. The decryption policy includes rules to decrypt all traffic to critical medical cloud services (EHR, PACS) and social media sites. What should the administrator do first to reduce CPU load?

Question 56hardmultiple choice

Read the full Decryption and Monitoring explanation →

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

Question 57mediummultiple choice

Read the full Decryption and Monitoring explanation →

A university uses a Palo Alto firewall for outbound SSL decryption. The IT helpdesk receives complaints that students cannot access certain educational resource websites (e.g., online libraries, research databases) after decryption was enabled. The firewall logs show 'decryption failure' for these sites with reason 'certificate validation failure'. The decryption profile is set to 'Block sessions with expired certificates' and 'Block sessions with untrusted issuers'. The helpdesk verifies that the root CA certificate is installed on all endpoints. The issue is intermittent and only affects a few sites. What should the administrator do?

Question 58hardmultiple choice

Read the full Decryption and Monitoring explanation →

A company has a Palo Alto firewall with both inbound and outbound decryption. The security team notices that some traffic to a specific internal server is being double-decrypted: first by inbound decryption when the client is internal, and second by outbound decryption when the server initiates connections to external resources. This causes performance issues and certificate warnings. The firewall policy has separate rules for inbound and outbound decryption, and all internal traffic passes through the firewall. How should the administrator resolve this?

Question 59mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. An administrator notices a high number of decryption failures. What is the most likely cause?

Exhibit

# show decryption statistics
Decryption failures: 120
  SSL handshake failures: 80
  Certificate validation failures: 40
  Decryption successful: 980

Question 60easymulti select

Read the full Decryption and Monitoring explanation →

Which TWO actions are recommended for monitoring decrypted traffic on a Palo Alto Networks firewall?

Question 61hardmultiple choice

Read the full Decryption and Monitoring explanation →

A large enterprise uses Palo Alto Networks firewalls with SSL Forward Proxy to inspect all HTTPS traffic (port 443) from internal users. Recently, users have reported slow web browsing and intermittent failures when accessing certain financial and healthcare websites. The firewall's dataplane CPU consistently reaches 85-95% during business hours. The decryption policy is configured with a single rule that decrypts all outbound HTTPS traffic using the default SSL Forward Proxy settings. The firewall is a PA-5250 with ample license capacity. What should the administrator do to resolve the performance issues while maintaining security posture?

Question 62hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A network administrator notices that SSL decryption performance has degraded. Based on the exhibit, which factor is most likely contributing to the performance issue?

Exhibit

admin@PA-5050> show system info | match uptime

Uptime: 12 days, 4 hours, 23 minutes

admin@PA-5050> show running resource-monitor

Resource Monitor:
  Data Plane CPU: 78%
  Data Plane Memory: 82%
  Session Utilization: 95%
  Session Capacity: 1000000
  Active Sessions: 950000
  SSL/TLS Proxy Sessions: 5000
  Decryption Policy Matches: 12000

Question 63mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A security analyst wants to ensure that all HTTPS traffic from internal users to the internet is decrypted for inspection. However, traffic from the 'corp-users' group is being blocked instead of decrypted. Which configuration change should be made?

Exhibit

admin@PA-3020> show running decryption policy

Decryption Policy:
  #  Name              Source Zone   Dest Zone    Source User   Destination   Service   Action
  1  No-Decrypt-Int    internal       external       any          any           any       no-decrypt
  2  Decrypt-Corp       internal       external       corp-users   any           service-https   decrypt
  3  Decrypt-All        external       internal       any          any           service-https   decrypt
  4  Block-No-Decrypt  internal       external       any          any           any       block

Question 64hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A network engineer observes a high number of SSL handshake failures. Which action is most likely to reduce these failures?

Exhibit

admin@PA-5250> show ssl-decrypt statistics

SSL Decryption Statistics:
  Total Sessions Inspected: 15000
  Sessions Decrypted Successfully: 12000
  Sessions Failed: 3000
    - SSL Handshake Failure: 2000
    - Certificate Validation Failure: 500
    - Unsupported Cipher: 300
    - Other: 200

admin@PA-5250> show ssl-decrypt certificate cache

Certificate Cache: size 10000, active 9500
  Forward Trust Certificate: CN=PA-Forward-Trust
  Forward Untrust Certificate: CN=PA-Forward-Untrust

Question 65mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. An administrator notices that some HTTPS sessions are not being decrypted. Which configuration change would address the most common cause of decryption failures shown?

Exhibit

admin@PA-220> show logging system | match ssl

2023-06-15 10:23:45 severity=warning msg="SSL decryption: certificate validation failed for session 12345, server certificate expired"
2023-06-15 10:24:01 severity=info msg="SSL decryption: session 12346 decrypted successfully"
2023-06-15 10:24:15 severity=warning msg="SSL decryption: session 12347 failed, unsupported protocol version"

Question 66hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. An administrator configures decryption for HTTPS traffic from internal users. However, traffic using TLS 1.3 is not being decrypted. Which change should be made to decrypt TLS 1.3 traffic?

Exhibit

{
  "decryption-policy": {
    "rules": [
      {
        "name": "Decrypt-HTTPs-Corp",
        "source-zones": ["internal"],
        "dest-zones": ["external"],
        "source-users": ["corp-users"],
        "destination-addresses": ["any"],
        "service": ["service-https"],
        "action": "decrypt",
        "decryption-profile": "Standard-Decrypt"
      }
    ]
  },
  "decryption-profile": {
    "name": "Standard-Decrypt",
    "ssl-decrypt-settings": {
      "forward-trust-cert": "PA-Forward-Trust",
      "forward-untrust-cert": "PA-Forward-Untrust",
      "decrypt-unknown-protocol": false,
      "ssl-protocol-settings": {
        "min-version": "tls1-0",
        "max-version": "tls1-2"
      }
    }
  }
}

Question 67hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A security engineer observes that SSL decryption is not working for session 1. The policy and session table are shown. What is the most likely reason?

Exhibit

admin@PA-220> show session all
Total sessions: 3

ID   Application      State   Type   Src IP:Port      Dst IP:Port          Protocol   Ingress   Egress
1    ssl              ACTIVE  FLOW   10.0.0.1:44321   192.168.1.100:443     tcp        eth1/1    eth1/2
2    web-browsing     ACTIVE  FLOW   10.0.0.2:53241   192.168.1.200:80      tcp        eth1/1    eth1/2
3    dns              ACTIVE  FLOW   10.0.0.3:45321   8.8.8.8:53            udp        eth1/1    eth1/3

admin@PA-220> show running security-policy
name    from    to      source      destination    application    action   decrypt
POL-1   trust   untrust 10.0.0.0/24 192.168.1.0/24 ssl            allow    forward-proxy
POL-2   trust   untrust 10.0.0.0/24 any             web-browsing   allow    no-decrypt
POL-3   trust   untrust 10.0.0.0/24 any             dns            allow    no-decrypt

admin@PA-220> show decryption statistics
Forward Proxy SSL/TLS Decryption: 0 sessions, 0 bytes decrypted

Question 68hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A user reports that they receive a certificate warning when accessing https://example.com. The firewall is configured to decrypt SSL traffic. What is the most likely cause?

Exhibit

admin@PA-220> show decryption policy
name             from      to        source           destination        service   action       type
Decrypt-Traffic  trust     untrust   10.0.0.0/24      0.0.0.0/0          any       decrypt      ssl-forward-proxy

admin@PA-220> show ssl-decrypt certificate-status
Certificate: PA-Forward-Proxy-CA
  Issuer: CN=PA-Forward-Proxy-CA
  Valid: 2024-01-01 to 2025-01-01
  Status: valid

admin@PA-220> show system log | match ssl
2024-06-15 10:30:22  ssl_decrypt  error  Certificate is not trusted by client.  Src: 10.0.0.5 Dst: 93.184.216.34

Question 69mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A security analyst notices that URL filtering is blocking some requests, but decryption is working. What can be concluded about the traffic that is being decrypted?

Exhibit

admin@PA-220> show system log | tail -20
2024-06-15 11:00:01  threat  url  example.com  spyware  blocked  high
2024-06-15 11:00:02  threat  url  badsite.com  malware  blocked  critical
2024-06-15 11:00:03  system  config  commit  admin  success

admin@PA-220> show url-filtering statistics
URL Filtering Profile: strict-profile
  Total requests: 1500
  Blocked: 45
  Allowed: 1455
  Categories: malware, spyware, phishing

admin@PA-220> show decryption statistics
Forward Proxy SSL/TLS Decryption: 1200 sessions, 45 MB decrypted

admin@PA-220> show running global-protect
No GlobalProtect configured

Question 70hardmultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. An administrator configured SSH decryption, but the firewall logs an error. What is the most likely cause of this error?

Exhibit

admin@PA-220> show decryption policy
name             from      to        source           destination        service   action       type
Decrypt-SSH      trust     untrust   10.0.0.0/24      0.0.0.0/0          any       decrypt      ssh-proxy

admin@PA-220> show session all
Total sessions: 1

ID   Application      State   Type   Src IP:Port      Dst IP:Port          Protocol   Ingress   Egress
1    ssh              ACTIVE  FLOW   10.0.0.10:22     192.168.1.50:22       tcp        eth1/1    eth1/2

admin@PA-220> show system log | match ssh
2024-06-15 12:00:00  ssh_decrypt  error  Failed to decrypt SSH session: unsupported key exchange algorithm.  Src: 10.0.0.10 Dst: 192.168.1.50

Question 71mediummultiple choice

Read the full Decryption and Monitoring explanation →

Refer to the exhibit. A user at 10.0.0.5 is accessing https://internal-server (192.168.1.50:443). The administrator wants to decrypt this traffic but notices it is not being decrypted. What is the most likely reason?

Exhibit

admin@PA-220> show running security-policy
name    from    to      source      destination    application    action   decrypt
POL-1   trust   untrust 10.0.0.0/24 any             ssl            allow    no-decrypt
POL-2   trust   untrust 10.0.0.0/24 192.168.1.0/24  ssl            allow    forward-proxy
POL-3   trust   untrust 10.0.0.0/24 any             web-browsing   allow    no-decrypt

admin@PA-220> show session all
Total sessions: 1

ID   Application      State   Type   Src IP:Port      Dst IP:Port          Protocol   Ingress   Egress
1    ssl              ACTIVE  FLOW   10.0.0.5:44321   192.168.1.50:443      tcp        eth1/1    eth1/2

Refer to the exhibit. # show system info | match decrypt Decryption status: enabled Decryption sessions: 523 (current), 1024 (peak) Certificate errors: 12 (since last hour) # show decryption statistics Policy hits: Decrypt: 1500, No Decrypt: 300 TLS version failures: 5 (TLS 1.0: 3, TLS 1.1: 2)

Refer to the exhibit. { "decryption_rules": [ { "name": "rule1", "source_zone": ["trust"], "destination_zone": ["untrust"], "source_address": ["any"], "destination_address": ["any"], "category": ["financial-services"], "action": "no-decrypt", "description": "Skip decryption for finance sites" }, { "name": "rule2", "source_zone": ["trust"], "destination_zone": ["untrust"], "source_address": ["any"], "destination_address": ["any"], "category": ["any"], "action": "decrypt", "description": "Decrypt all other traffic" } ] }

Refer to the exhibit. ``` admin@PA-500> show decryption statistics Decryption Statistics: Total Sessions Decrypted: 1500 Total Sessions Failed: 50 Failed Reasons: handshake_failure: 30 certificate_unknown: 15 decryption_error: 5 ```

Refer to the exhibit. ``` admin@PA-500> show running decryption-policy Decryption policy: # name from to source destination service action profile 1 decrypt-all trust untrust any any any decrypt default 2 no-decrypt-fin trust untrust 10.0.0.0/24 192.168.1.0/24 any no-decrypt none 3 decrypt-inbound untrust trust any 10.0.0.5/32 https decrypt inbound ```

Refer to the exhibit. ``` admin@PA-500> show log traffic | match 10.0.0.5 Time Source Dest Application Action Decrypted 2023/01/01 10.0.0.5 192.168.1.1 ssl allow yes 2023/01/01 10.0.0.5 8.8.8.8 dns allow no ```

admin@PA-5050> show system info | match uptime Uptime: 12 days, 4 hours, 23 minutes admin@PA-5050> show running resource-monitor Resource Monitor: Data Plane CPU: 78% Data Plane Memory: 82% Session Utilization: 95% Session Capacity: 1000000 Active Sessions: 950000 SSL/TLS Proxy Sessions: 5000 Decryption Policy Matches: 12000

admin@PA-3020> show running decryption policy Decryption Policy: # Name Source Zone Dest Zone Source User Destination Service Action 1 No-Decrypt-Int internal external any any any no-decrypt 2 Decrypt-Corp internal external corp-users any service-https decrypt 3 Decrypt-All external internal any any service-https decrypt 4 Block-No-Decrypt internal external any any any block

admin@PA-5250> show ssl-decrypt statistics SSL Decryption Statistics: Total Sessions Inspected: 15000 Sessions Decrypted Successfully: 12000 Sessions Failed: 3000 - SSL Handshake Failure: 2000 - Certificate Validation Failure: 500 - Unsupported Cipher: 300 - Other: 200 admin@PA-5250> show ssl-decrypt certificate cache Certificate Cache: size 10000, active 9500 Forward Trust Certificate: CN=PA-Forward-Trust Forward Untrust Certificate: CN=PA-Forward-Untrust

admin@PA-220> show logging system | match ssl 2023-06-15 10:23:45 severity=warning msg="SSL decryption: certificate validation failed for session 12345, server certificate expired" 2023-06-15 10:24:01 severity=info msg="SSL decryption: session 12346 decrypted successfully" 2023-06-15 10:24:15 severity=warning msg="SSL decryption: session 12347 failed, unsupported protocol version"

{ "decryption-policy": { "rules": [ { "name": "Decrypt-HTTPs-Corp", "source-zones": ["internal"], "dest-zones": ["external"], "source-users": ["corp-users"], "destination-addresses": ["any"], "service": ["service-https"], "action": "decrypt", "decryption-profile": "Standard-Decrypt" } ] }, "decryption-profile": { "name": "Standard-Decrypt", "ssl-decrypt-settings": { "forward-trust-cert": "PA-Forward-Trust", "forward-untrust-cert": "PA-Forward-Untrust", "decrypt-unknown-protocol": false, "ssl-protocol-settings": { "min-version": "tls1-0", "max-version": "tls1-2" } } } }

admin@PA-220> show session all Total sessions: 3 ID Application State Type Src IP:Port Dst IP:Port Protocol Ingress Egress 1 ssl ACTIVE FLOW 10.0.0.1:44321 192.168.1.100:443 tcp eth1/1 eth1/2 2 web-browsing ACTIVE FLOW 10.0.0.2:53241 192.168.1.200:80 tcp eth1/1 eth1/2 3 dns ACTIVE FLOW 10.0.0.3:45321 8.8.8.8:53 udp eth1/1 eth1/3 admin@PA-220> show running security-policy name from to source destination application action decrypt POL-1 trust untrust 10.0.0.0/24 192.168.1.0/24 ssl allow forward-proxy POL-2 trust untrust 10.0.0.0/24 any web-browsing allow no-decrypt POL-3 trust untrust 10.0.0.0/24 any dns allow no-decrypt admin@PA-220> show decryption statistics Forward Proxy SSL/TLS Decryption: 0 sessions, 0 bytes decrypted

admin@PA-220> show decryption policy name from to source destination service action type Decrypt-Traffic trust untrust 10.0.0.0/24 0.0.0.0/0 any decrypt ssl-forward-proxy admin@PA-220> show ssl-decrypt certificate-status Certificate: PA-Forward-Proxy-CA Issuer: CN=PA-Forward-Proxy-CA Valid: 2024-01-01 to 2025-01-01 Status: valid admin@PA-220> show system log | match ssl 2024-06-15 10:30:22 ssl_decrypt error Certificate is not trusted by client. Src: 10.0.0.5 Dst: 93.184.216.34

admin@PA-220> show system log | tail -20 2024-06-15 11:00:01 threat url example.com spyware blocked high 2024-06-15 11:00:02 threat url badsite.com malware blocked critical 2024-06-15 11:00:03 system config commit admin success admin@PA-220> show url-filtering statistics URL Filtering Profile: strict-profile Total requests: 1500 Blocked: 45 Allowed: 1455 Categories: malware, spyware, phishing admin@PA-220> show decryption statistics Forward Proxy SSL/TLS Decryption: 1200 sessions, 45 MB decrypted admin@PA-220> show running global-protect No GlobalProtect configured

admin@PA-220> show decryption policy name from to source destination service action type Decrypt-SSH trust untrust 10.0.0.0/24 0.0.0.0/0 any decrypt ssh-proxy admin@PA-220> show session all Total sessions: 1 ID Application State Type Src IP:Port Dst IP:Port Protocol Ingress Egress 1 ssh ACTIVE FLOW 10.0.0.10:22 192.168.1.50:22 tcp eth1/1 eth1/2 admin@PA-220> show system log | match ssh 2024-06-15 12:00:00 ssh_decrypt error Failed to decrypt SSH session: unsupported key exchange algorithm. Src: 10.0.0.10 Dst: 192.168.1.50

admin@PA-220> show running security-policy name from to source destination application action decrypt POL-1 trust untrust 10.0.0.0/24 any ssl allow no-decrypt POL-2 trust untrust 10.0.0.0/24 192.168.1.0/24 ssl allow forward-proxy POL-3 trust untrust 10.0.0.0/24 any web-browsing allow no-decrypt admin@PA-220> show session all Total sessions: 1 ID Application State Type Src IP:Port Dst IP:Port Protocol Ingress Egress 1 ssl ACTIVE FLOW 10.0.0.5:44321 192.168.1.50:443 tcp eth1/1 eth1/2