PCNSA Decryption and Monitoring Practice Test 2 — 15 Questions

Question 1

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inbound Inspection Decryption. Inbound Inspection Decryption is used to decrypt traffic destined to a protected server, such as a web server using HTTPS. In this scenario, the firewall acts as a reverse proxy, intercepting inbound connections to the server and decrypting them for inspection before re-encrypting and forwarding the traffic. This allows the security administrator to inspect the payload of HTTPS traffic without requiring client-side configuration.

Answer

Decryption Mirror

Answer

Outbound (Forward Proxy) Decryption

Answer

SSH Proxy

Question 2

A company wants to decrypt all SSL/TLS traffic from internal users except traffic to financial sites. The firewall is placed as a forward proxy. Which policy configuration ensures that traffic to financial sites is not decrypted?

Accepted Answer

Create a decryption policy with action 'no-decrypt' for traffic to financial sites, and a catch-all decryption policy with action 'decrypt' for all other traffic.. It uses a specific 'no-decrypt' action in a decryption policy for financial sites, which explicitly excludes them from SSL/TLS decryption. A catch-all policy with 'decrypt' then ensures all other internal user traffic is decrypted. This approach directly aligns with the forward proxy requirement to decrypt all traffic except the specified financial sites.

Answer

Create a decryption policy and use the 'exclude cache' option for financial sites.

Answer

Create a security policy that allows financial sites without decryption; then create a decryption policy with action 'no-decrypt' for those sites.

Answer

Create a decryption policy with action 'decrypt' and a source zone of internal; then create a decryption exemption for financial URLs.

Question 3

During troubleshooting, a firewall shows a large number of SSL decryption failures with error 'certificate_unknown'. The firewall is configured for forward proxy decryption. What is the most likely cause?

Accepted Answer

The firewall cannot reach the CRL or OCSP responder to validate the server certificate.. In forward proxy decryption, the firewall must validate the server certificate against a Certificate Revocation List (CRL) or via OCSP to ensure it hasn't been revoked. A 'certificate_unknown' error specifically indicates that the firewall cannot determine the revocation status of the server certificate, often because it cannot reach the CRL distribution point or OCSP responder. This is distinct from a certificate that is simply expired or untrusted by the client.

Answer

The client does not trust the firewall's CA certificate.

Answer

The server certificate is expired.

Answer

The decryption policy has an incorrect source zone.

Question 4

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 5

A network administrator wants to monitor HTTPS traffic without decrypting it, but still wants to identify the applications being used. Which feature can be used to identify HTTPS applications without decryption?

Accepted Answer

App-ID with SSL protocol detection. App-ID with SSL protocol detection allows the firewall to identify HTTPS applications by inspecting the Server Name Indication (SNI) field in the TLS handshake and the certificate common name, without decrypting the traffic. This enables application identification while preserving encryption, meeting the requirement to monitor HTTPS traffic without decryption.

Answer

SSL Decryption Mirror

Answer

SSL Forward Proxy

Answer

URL Filtering

Question 6

A firewall administrator notices that traffic from an internal user is being decrypted, but the user's browser shows a certificate warning. The firewall uses a CA certificate issued by the company's internal PKI. What is the most likely reason for the browser warning?

Accepted Answer

The firewall's root CA certificate is not installed in the user's browser trusted root store.. The browser warning indicates that the firewall's decrypted traffic is being signed with a certificate that the browser does not trust. When a firewall performs SSL/TLS decryption using a CA certificate from the company's internal PKI, the browser will only trust the decrypted connections if the root CA certificate of that PKI is installed in the browser's trusted root certificate store. Without this trust anchor, the browser cannot validate the certificate chain presented by the firewall, resulting in a certificate warning.

Answer

The decryption policy has the action 'decrypt' but no certificate profile.

Answer

The user's browser does not support TLS 1.2.

Answer

The server certificate is revoked.

Question 7

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

Accepted Answer

SSH Proxy. SSH traffic uses its own encryption protocol, not SSL/TLS. To decrypt SSH traffic, the firewall must act as a man-in-the-middle using an SSH proxy, which terminates the client's SSH connection and establishes a separate SSH session with the server, allowing inspection of the plaintext content. This is distinct from SSL decryption methods.

Answer

SSL Forward Proxy

Answer

Inbound Inspection

Answer

Decryption Mirror

Question 8

A company wants to ensure that decryption policies are applied based on the user identity. The firewall is integrated with Active Directory. Which decryption policy matching criteria should be used?

Accepted Answer

Source user. Source user allows matching based on user identity from AD.

Answer

URL category

Answer

Source zone

Answer

Source IP address

Question 9

A firewall is experiencing high CPU utilization due to SSL decryption. The administrator wants to reduce the load without completely disabling decryption. Which action should be taken?

Accepted Answer

Create a decryption bypass for traffic to high-bandwidth sites with low security risk.. Creating a decryption bypass for traffic to high-bandwidth, low-risk sites reduces the CPU load from SSL decryption by exempting that traffic from decryption, while still allowing decryption for higher-risk traffic. This targeted approach maintains security posture without completely disabling decryption, aligning with best practices for managing decryption resources on Palo Alto Networks firewalls.

Answer

Use decryption mirroring to offload decryption to a dedicated appliance.

Answer

Change decryption policy to 'no-decrypt' for all traffic.

Answer

Enable SSL/TLS protocol settings to disable weak ciphers.

Question 10

A security analyst is troubleshooting a decryption issue. Which TWO logs are most useful for identifying decryption failures? (Choose two.)

Accepted Answer

Traffic Logs. Traffic Logs (B) are most useful because they record the result of decryption actions, including whether decryption was applied and if it succeeded or failed, with specific error codes. Decryption Logs (E) are dedicated logs that capture detailed decryption events, such as handshake failures, certificate errors, or unsupported cipher suites, making them essential for troubleshooting decryption failures.

Answer

Config Logs

Answer

System Logs

Answer

Threat Logs

Question 11

Which THREE actions can be performed in a decryption policy? (Choose three.)

Accepted Answer

No-decrypt. In Palo Alto Networks decryption policy, the valid actions are Decrypt, No-decrypt, and Block. These three actions control how traffic is handled. Option D (Block) is indeed a valid decryption policy action; it is used to block traffic when decryption cannot be performed or is not allowed. Options A (App-ID) and B (Allow) are not decryption policy actions; they are security policy actions.

Answer

App-ID

Answer

Allow

Question 12

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Accepted Answer

The firewall's root CA certificate deployed to client browsers. In forward proxy decryption, the firewall acts as a trusted intermediary by generating a certificate for each HTTPS site the user visits, signed by the firewall's own root CA. For this to work without browser security warnings, the firewall's root CA certificate must be deployed to every client browser's trusted root store. This allows the browser to trust the firewall's dynamically generated server certificates, enabling seamless decryption and inspection of outbound SSL/TLS traffic.

Answer

The server's private key

Answer

A security policy rule allowing decrypted traffic

Question 13

An administrator runs the command and sees the above output. What is the most likely cause of the large number of handshake failures?

Accepted Answer

The server is using an unsupported cipher suite.. The output shows a large number of handshake failures, which typically occur during the SSL/TLS handshake when the client and server cannot agree on a common cipher suite. If the server only supports weak or outdated ciphers that the firewall's decryption policy does not allow, or if the firewall's SSL forward proxy engine does not support the server's chosen cipher, the handshake will fail. This is the most likely cause because cipher suite mismatch is a common source of handshake failures in decryption environments.

Answer

The firewall's CRL server is unreachable.

Answer

The decryption policy is not matching the traffic.

Answer

The firewall's certificate is not trusted by clients.

Question 14

A user at IP 10.0.0.10 is accessing a server at 192.168.1.5. According to the decryption policy, what will happen to the traffic?

Accepted Answer

The traffic will not be decrypted because of the no-decrypt rule.. The decryption policy contains a no-decrypt rule that matches traffic from source IP 10.0.0.10 to destination IP 192.168.1.5. Since the no-decrypt rule explicitly excludes this traffic from decryption, the firewall will forward the traffic without applying any decryption profile. This is the correct behavior because no-decrypt rules take precedence over decrypt rules for matching traffic.

Answer

The traffic will be decrypted using the default profile.

Answer

The traffic will be decrypted using the inbound profile.

Answer

The traffic will be blocked because no security rule allows it.

Question 15

An administrator sees the above traffic log entries. What can be concluded about the traffic to 192.168.1.1?

Accepted Answer

The traffic was decrypted because it matched a decryption policy.. The traffic log entries indicate that the session to 192.168.1.1 was decrypted, as shown by the decryption flag or action field (e.g., 'decrypt'). This occurs when the traffic matches a decryption policy configured on the firewall, typically for SSL/TLS inspection. The destination being internal (192.168.1.1) and the application being SSL are not sufficient conditions for decryption; a matching decryption rule is required.

Answer

The traffic was decrypted because the application is SSL.

Answer

The traffic was not decrypted because it matched a no-decrypt policy.

Answer

The traffic was not decrypted because the destination is external.