PCNSA Decryption and Monitoring Practice Test 2 — 15 Questions

Question 1

An administrator wants to view logs related to decryption failures. Which log type should they use?

Accepted Answer

Traffic logs. Traffic logs capture all session-level events, including decryption failures, because they record the action taken by the firewall (e.g., 'decrypt', 'no-decrypt', or 'decrypt-error'). When decryption fails due to issues like certificate validation errors, unsupported cipher suites, or handshake failures, the firewall logs the session as a traffic log entry with a specific reason code. This makes Traffic logs the correct source for troubleshooting decryption failures.

Answer

Threat logs

Answer

URL Filtering logs

Answer

System logs

Question 2

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Accepted Answer

The firewall is not configured to forward client certificates. SSL Forward Proxy decryption intercepts and re-encrypts traffic, which strips the original client certificate from the TLS handshake. For internal applications that require client certificate authentication, the firewall must be explicitly configured to forward the client certificate to the destination server. Without this forwarding, the server never receives the certificate, causing authentication failures.

Answer

The SSL/TLS service profile does not allow self-signed certificates

Answer

The decryption profile's 'Block Unsupported Modes' is enabled

Answer

The decryption policy is set to 'decrypt' but not 'proxy'

Question 3

Which TWO actions should be taken when configuring SSL Forward Proxy decryption? (Select exactly two.)

Accepted Answer

Generate or import a CA certificate for the firewall. SSL Forward Proxy decryption requires the firewall to act as a trusted intermediary. To do this, the firewall must generate or import a CA certificate that client browsers will trust, allowing it to dynamically generate and sign server certificates for decrypted sessions. Without this CA certificate, clients will receive untrusted certificate warnings, and decryption will fail.

Answer

Import the server's private key

Answer

Import the server certificate

Answer

Enable SSH decryption

Question 4

After enabling SSL decryption, users report that some websites fail to load. The firewall logs show 'decryption error' for these sites. Which decryption profile setting should the administrator check first?

Accepted Answer

Block sessions with untrusted issuers. When SSL decryption is enabled, the firewall acts as a man-in-the-middle and must re-sign the server's certificate with its own CA. If the server's certificate is issued by an untrusted CA (i.e., not in the firewall's trusted CA list), the firewall cannot verify the chain of trust and will block the session if the 'Block sessions with untrusted issuers' option is enabled. This is the most common cause of 'decryption error' logs for sites that previously worked without decryption.

Answer

Block sessions with expired certificates

Answer

Block sessions with certificate status unknown

Answer

Block sessions with unsupported cipher suites

Question 5

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

Accepted Answer

The decryption rule is configured with the forward proxy method.. Inbound SSL decryption requires the 'SSL Inbound Inspection' method, not the forward proxy method. Forward proxy is used for outbound decryption where the firewall generates a certificate on the fly. For inbound decryption, the firewall must use the server's private key to decrypt traffic, which is configured via an SSL Inbound Inspection rule. Since the rule is set to forward proxy, the firewall attempts to re-encrypt with its own certificate, causing a certificate mismatch and the 'secure connection' error.

Answer

The firewall does not support wildcard certificates for inbound decryption.

Answer

The web server is not properly configured to handle decrypted traffic.

Answer

The decryption profile is set to 'Block sessions with untrusted certificates'.

Question 6

A university uses a Palo Alto firewall for outbound SSL decryption. The IT helpdesk receives complaints that students cannot access certain educational resource websites (e.g., online libraries, research databases) after decryption was enabled. The firewall logs show 'decryption failure' for these sites with reason 'certificate validation failure'. The decryption profile is set to 'Block sessions with expired certificates' and 'Block sessions with untrusted issuers'. The helpdesk verifies that the root CA certificate is installed on all endpoints. The issue is intermittent and only affects a few sites. What should the administrator do?

Accepted Answer

Use a decryption profile that allows sessions with certificate status unknown.. The 'decryption failure' with 'certificate validation failure' and 'certificate status unknown' indicates that the firewall cannot determine the revocation status of the site's certificate (e.g., no CRL or OCSP responder reachable). The current decryption profile blocks sessions with expired certificates and untrusted issuers, but it does not explicitly block sessions with 'certificate status unknown'. By using a decryption profile that allows sessions with certificate status unknown, the firewall will permit the SSL handshake to proceed even when revocation checking fails, resolving the intermittent access issues for those specific educational sites.

Answer

Update the firewall's certificate revocation list (CRL).

Answer

Add the websites to a decryption policy exception rule.

Answer

Disable blocking for untrusted issuers in the decryption profile.

Question 7

A company has a Palo Alto firewall with both inbound and outbound decryption. The security team notices that some traffic to a specific internal server is being double-decrypted: first by inbound decryption when the client is internal, and second by outbound decryption when the server initiates connections to external resources. This causes performance issues and certificate warnings. The firewall policy has separate rules for inbound and outbound decryption, and all internal traffic passes through the firewall. How should the administrator resolve this?

Accepted Answer

Ensure that the inbound decryption rule only applies to traffic from external sources, not internal.. The core issue is that inbound decryption is incorrectly applied to traffic from internal clients to the internal server, causing double decryption when the server subsequently initiates outbound connections. By ensuring the inbound decryption rule only applies to traffic from external sources (i.e., source zone is untrust), internal-to-internal traffic bypasses inbound decryption, eliminating the double-decryption loop. This aligns with best practices where inbound decryption is scoped to traffic originating outside the network.

Answer

Create a decryption exclusion rule for traffic between internal clients and the internal server.

Answer

Disable outbound decryption for the subnet of the internal server.

Answer

Use a no-decrypt rule for traffic from the internal server's IP to the internet.

Question 8

Which TWO actions are recommended for monitoring decrypted traffic on a Palo Alto Networks firewall?

Accepted Answer

Create an ACC filter for decrypted sessions.. Option B is correct because the Application Command Center (ACC) in PAN-OS lets you filter on decrypted sessions, so you can visualize and monitor which applications and traffic are being decrypted in real time. Option D is correct because enabling logging on decryption policies causes the firewall to generate decryption log entries for matching sessions, giving you the visibility needed to monitor decrypted traffic. Option A is wrong because disabling decryption during peak hours reduces visibility rather than improving monitoring. Option C is wrong because there is no separate 'decryption' log type in PAN-OS; decryption events are captured through decryption policy logging and related logs such as traffic and URL filtering. Option E is wrong because exporting decrypted traffic to a log collector is not a recommended monitoring action and does not by itself provide decryption visibility.

Answer

Disable decryption during peak hours.

Answer

Use the 'decryption' log type.

Answer

Export decrypted traffic to a log collector.

Question 9

A large enterprise uses Palo Alto Networks firewalls with SSL Forward Proxy to inspect all HTTPS traffic (port 443) from internal users. Recently, users have reported slow web browsing and intermittent failures when accessing certain financial and healthcare websites. The firewall's dataplane CPU consistently reaches 85-95% during business hours. The decryption policy is configured with a single rule that decrypts all outbound HTTPS traffic using the default SSL Forward Proxy settings. The firewall is a PA-5250 with ample license capacity. What should the administrator do to resolve the performance issues while maintaining security posture?

Accepted Answer

Implement decryption exclusion rules for financial and healthcare websites.. Financial and healthcare websites often use certificate pinning or require specific cipher suites that may not be compatible with the firewall's default SSL Forward Proxy settings. By excluding these sites from decryption, the administrator reduces the decryption load on the dataplane CPU and avoids breaking connectivity to sensitive sites, while still decrypting the majority of HTTPS traffic to maintain security posture.

Answer

Increase the maximum number of concurrent SSL sessions allowed.

Answer

Disable decryption for high-bandwidth websites such as video streaming services.

Answer

Enable hardware acceleration for SSL decryption.

Question 10

Refer to the exhibit. A network administrator notices that SSL decryption performance has degraded. Based on the exhibit, which factor is most likely contributing to the performance issue?

Accepted Answer

The decryption policy matches (12000) are high relative to the number of SSL/TLS proxy sessions (5000), indicating many sessions are being decrypted but then possibly dropped or not fully processed.. The exhibit likely shows that decryption policy matches (12000) are high relative to SSL/TLS proxy sessions (5000), indicating many sessions are being decrypted but not fully processed, possibly due to policy misconfigurations or resource bottlenecks. This mismatch suggests that the firewall is spending resources on decryption attempts that are then dropped or not fully handled, leading to performance degradation.

Answer

The firewall has been running for too long without a reboot.

Answer

The session utilization is at 95%, nearing the capacity limit, but decryption sessions are only a small fraction.

Answer

The data plane CPU and memory are both high, indicating resource exhaustion.

Question 11

Refer to the exhibit. A security analyst wants to ensure that all HTTPS traffic from internal users to the internet is decrypted for inspection. However, traffic from the 'corp-users' group is being blocked instead of decrypted. Which configuration change should be made?

Accepted Answer

Move rule 2 above rule 1.. In a Palo Alto Networks firewall, decryption policies are evaluated in order from top to bottom, and the first matching rule is applied. Since rule 1 (which blocks corp-users traffic) is above rule 2 (which decrypts traffic), the block action is taken before the decryption rule can be evaluated. Moving rule 2 above rule 1 ensures that decryption is applied first to corp-users traffic, allowing inspection before any blocking action.

Answer

Add a new rule above rule 1 to decrypt corp-users traffic.

Answer

Change rule 4 to 'allow' instead of 'block'.

Answer

Change rule 2 to use 'any' for source user.

Question 12

Refer to the exhibit. A network engineer observes a high number of SSL handshake failures. Which action is most likely to reduce these failures?

Accepted Answer

Ensure the forward trust certificate is trusted by internal clients.. The majority of failures are SSL handshake failures (2000 out of 3000). A common reason is that the forward trust certificate is not trusted by clients, causing the client to reject the connection during the handshake.

Answer

Disable decryption for traffic using unsupported ciphers.

Answer

Reissue the forward untrust certificate with a stronger key size.

Answer

Increase the certificate cache size to accommodate more certificates.

Question 13

Refer to the exhibit. An administrator notices that some HTTPS sessions are not being decrypted. Which configuration change would address the most common cause of decryption failures shown?

Accepted Answer

Enable 'allow expired certificates' in the SSL decryption profile.. The most common cause of SSL decryption failures in Palo Alto Networks firewalls is an expired certificate presented by the server. By default, the firewall blocks sessions with expired certificates during decryption. Enabling 'allow expired certificates' in the SSL decryption profile allows the firewall to proceed with decryption even if the server certificate has expired, thus addressing the most frequent decryption failure. This setting is found under the decryption profile's SSL protocol settings and is specifically designed to handle this scenario.

Answer

Configure a forward trust certificate that is valid and trusted.

Answer

Increase the session timeout for decryption.

Answer

Enable support for SSLv3 in the decryption profile.

Question 14

Refer to the exhibit. An administrator configures decryption for HTTPS traffic from internal users. However, traffic using TLS 1.3 is not being decrypted. Which change should be made to decrypt TLS 1.3 traffic?

Accepted Answer

Change the 'ssl-protocol-settings' max-version to 'tls1-3'.. The decryption profile specifies max-version as tls1-2, which prevents decryption of TLS 1.3 traffic. Updating the max-version to tls1-3 allows decryption of TLS 1.3 sessions.

Answer

Change the min-version to 'tls1-3'.

Answer

Add a new rule for TLS 1.3 traffic.

Answer

Enable 'decrypt-unknown-protocol' to capture all traffic.

Question 15

Refer to the exhibit. A security engineer observes that SSL decryption is not working for session 1. The policy and session table are shown. What is the most likely reason?

Accepted Answer

The decryption policy requires a certificate that is not installed on the firewall.. The session table shows an SSL session from 10.0.0.1 to 192.168.1.100:443, which matches POL-1 (forward-proxy). However, the decryption statistics show 0 sessions decrypted. The most likely cause is that the decryption policy requires a certificate to be imported and configured, and the firewall cannot perform decryption without a valid certificate. Other options (like policy order or application mismatch) are not supported by the exhibit.

Answer

The security policy is configured to allow SSL, but the decryption policy is not configured to decrypt SSL traffic.

Answer

The destination IP 192.168.1.100 is not in the decryption policy's destination list.

Answer

The firewall is not receiving the SSL handshake because the session is already established.