PCNSA Decryption and Monitoring Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A security analyst notices that URL filtering is blocking some requests, but decryption is working. What can be concluded about the traffic that is being decrypted?

Accepted Answer

The URL filtering profile is applied to the same rule that enables decryption.. The URL filtering statistics show total requests and blocked counts, but decryption statistics show 1200 sessions decrypted. The exhibit does not provide a direct correlation between decrypted sessions and URL filtering. However, since URL filtering inspects HTTP/HTTPS traffic, decryption enables it to see encrypted payloads. The blocked URLs (malware, spyware) likely come from decrypted sessions.

Answer

The firewall is decrypting traffic but not inspecting it for threats.

Answer

All decrypted traffic is inspected by URL filtering.

Answer

GlobalProtect is required for decryption to work.

Question 2

Refer to the exhibit. A user at 10.0.0.5 is accessing https://internal-server (192.168.1.50:443). The administrator wants to decrypt this traffic but notices it is not being decrypted. What is the most likely reason?

Accepted Answer

The security policy order is incorrect; POL-1 matches the traffic first and disables decryption.. In PAN-OS, security policies are evaluated top-down and the first matching rule is applied. If POL-1 matches the traffic (source 10.0.0.5, destination 192.168.1.50, port 443) and has decryption set to 'no-decrypt', the session is not decrypted regardless of POL-2's decryption setting. The most likely reason the traffic is not decrypted is that POL-1 shadows POL-2 by matching first.

Answer

The user's IP is not in the source range of POL-2.

Answer

The application is not correctly identified as SSL.

Answer

The decryption policy is not configured for the destination.

Question 3

A security administrator is configuring SSL decryption on a Palo Alto Networks firewall. The administrator wants to ensure that decrypted traffic is inspected for threats and that users are not presented with certificate warnings for trusted sites. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Enable SSL Forward Proxy and attach a decryption profile to the policy.. To enable SSL decryption and inspection without certificate warnings, the administrator must install the Forward Trust certificate on client systems and enable SSL Forward Proxy with a decryption profile. The decryption profile enforces checks on decrypted traffic, and the certificate ensures clients trust the firewall-generated certificates. Other options either bypass decryption or are not applicable to outbound traffic.

Answer

Configure SSL Inbound Inspection for all outbound traffic.

Answer

Set the decryption policy action to 'decrypt' for all traffic, including sensitive categories.

Answer

Configure a decryption policy with the action 'no-decrypt' for trusted sites.

Question 4

A network security administrator has configured SSL Forward Proxy decryption on a Palo Alto Networks firewall. After applying the decryption policy, users report that they can no longer access any HTTPS websites. The administrator checks the traffic logs and sees that all sessions are being reset. What is the most likely cause?

Accepted Answer

The forward trust and forward untrust certificates are not configured or trusted.. SSL Forward Proxy decryption requires the firewall to have a forward trust certificate to sign traffic to the client and a forward untrust certificate for untrusted server certificates. Without these, the firewall cannot establish separate SSL connections with the client and server, leading to handshake failures and session resets. The other options would not cause universal resets.

Answer

The decryption policy is set to 'no-decrypt' for all traffic.

Answer

The firewall's SSL decryption license has expired.

Answer

The client machines do not have the forward trust certificate installed in their trusted root store.

Question 5

A security administrator has configured SSL Forward Proxy decryption. Users report that when they visit certain banking websites, the browser displays a certificate warning, but other HTTPS sites work fine. The administrator checks the firewall and sees that the decryption policy is set to 'no-decrypt' for the banking category. What is the most likely cause of the certificate warning?

Accepted Answer

The no-decrypt policy is not matching, and the traffic is being decrypted, causing the browser to see a certificate not matching the banking site.. The no-decrypt policy is intended to bypass decryption for banking sites. If users see certificate warnings only for those sites, it suggests the policy is not matching and the traffic is being decrypted. The firewall then presents its own certificate, which may not be trusted or may not match the expected certificate, causing the warning.

Answer

The banking websites use certificate pinning, and the no-decrypt policy is causing the firewall to still intercept the connection.

Answer

The banking websites require TLS 1.3, which is not supported by the firewall's decryption engine.

Answer

The firewall's forward trust certificate is not trusted by the user's browser.

Question 6

A security administrator is troubleshooting why a Palo Alto Networks firewall does not decrypt traffic to a partner's web application at https://partner.example.net. The decryption policy rule for that destination is set to 'no-decrypt' with the action 'no-decrypt', and the administrator confirms the rule matches. The partner's application uses mutual TLS and rejects connections that do not present the client certificate. What is the most likely reason the firewall is not decrypting this traffic?

Accepted Answer

The firewall cannot decrypt mutual TLS traffic because it cannot present the client certificate required by the server.. Mutual TLS requires the client to authenticate with its own certificate. Because SSL Forward Proxy terminates the client-side connection and initiates a new connection to the server, the firewall would need the client's private key to satisfy the server's certificate request. Without it, the handshake fails, so mutual TLS applications are commonly excluded from decryption.

Answer

The partner's server uses an untrusted certificate chain, so the firewall automatically bypasses decryption for that destination.

Answer

The decryption policy rule is set to no-decrypt, which prevents the firewall from generating a forward trust certificate for the site.

Answer

The firewall's SSL Decryption license has expired, so it cannot process TLS 1.3 traffic to the partner site.

Question 7

A security administrator wants to ensure that the firewall logs all decrypted sessions and generates alerts for any decryption failures. Which log type should the administrator review to see details about decryption errors such as 'ssl-decrypt' failures?

Accepted Answer

Traffic log. The traffic log is the correct place to monitor decryption status because it records session details, including whether decryption was attempted and any errors encountered. By filtering for decryption errors, administrators can quickly identify and resolve issues. Other log types do not contain this information, making the traffic log essential for decryption monitoring.

Answer

Decryption log

Answer

URL filtering log

Answer

Threat log

Question 8

A security administrator is configuring SSL Forward Proxy decryption for outbound traffic. The administrator wants to ensure that the firewall does not decrypt traffic to sites that use certificate pinning, as decryption would break the application. Which feature should the administrator use to automatically exclude these sites from decryption based on the server certificate?

Accepted Answer

SSL Decryption Exclusion list. The SSL Decryption Exclusion list is designed to automatically bypass decryption for sessions matching specific certificate attributes. This is ideal for applications that use certificate pinning, as it prevents the firewall from decrypting and breaking those connections. Other options either block traffic or are not based on certificate attributes, making them unsuitable for this scenario.

Answer

Forward Untrust Certificate configuration

Answer

Decryption profile with 'Block sessions with untrusted issuers' enabled

Answer

No-decrypt policy rule based on URL category

Question 9

An administrator is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. The administrator wants to ensure that the firewall can properly decrypt traffic and that users do not experience certificate errors. Which two actions are required? (Choose two.)

Accepted Answer

Import a forward trust certificate and a forward untrust certificate.. To ensure SSL Forward Proxy decryption works without certificate errors, the firewall must have a forward trust certificate and a forward untrust certificate. Additionally, the forward trust certificate must be installed on client machines so they trust the firewall's re-signed certificates. These two actions are fundamental for proper decryption and user experience.

Answer

Configure a decryption profile to block untrusted certificates.

Answer

Configure a decryption policy rule with action 'decrypt' for the desired traffic.

Answer

Enable SSL decryption in the security policy rule.

Question 10

A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?

Accepted Answer

The firewall's CA certificate is not installed in the trusted root store on user endpoints.. SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.

Answer

The decryption policy uses 'No Decrypt' for the internal application's URL category.

Answer

The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.

Answer

The firewall is configured to decrypt traffic from the internal zone, but not the external zone.

Question 11

An organization deploys SSL Forward Proxy decryption. They want to ensure that traffic to financial websites is not decrypted due to compliance requirements. Which decryption policy configuration should be used?

Accepted Answer

Create a decryption rule with action 'No Decrypt' for the URL category 'Financial Services'.. SSL Forward Proxy decryption rules are evaluated in order, and the first matching rule determines the action. To exclude financial websites from decryption, you must create a rule with action 'No Decrypt' that matches the 'Financial Services' URL category. This ensures traffic to those sites is not decrypted, meeting compliance requirements.

Answer

Create a decryption rule with action 'Decrypt' and destination zone 'Untrust'.

Answer

Create a decryption rule with action 'No Decrypt' for all traffic, then a rule above it to decrypt all other traffic.

Answer

Create a decryption rule with action 'Decrypt' for the URL category 'Financial Services'.

Question 12

A company uses SSL Forward Proxy decryption. The firewall's decryption certificate expires. What immediate impact does this have on traffic?

Accepted Answer

Users receive certificate warnings when accessing HTTPS sites.. When the firewall's SSL Forward Proxy decryption certificate expires, the firewall can no longer present a valid certificate to clients during the SSL/TLS handshake. Browsers and applications will detect the expired certificate and display certificate warnings or errors to users, but the firewall may still attempt to decrypt traffic using the expired certificate, causing trust failures. This is the immediate impact because the firewall does not block traffic by default; it continues to proxy the connection, but the client rejects the invalid certificate.

Answer

The firewall logs a critical system alert.

Answer

Decryption stops working and all SSL traffic is blocked.

Answer

The firewall automatically renews the certificate from the CA.

Question 13

Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)

Accepted Answer

Exclude traffic to financial and healthcare sites from decryption.. Option C is correct because privacy and compliance regulations (such as PCI-DSS, HIPAA, and GDPR) prohibit or restrict the interception of traffic to financial and healthcare sites, so these destinations should be added to the SSL Forward Proxy decryption exclusion list to avoid legal and privacy violations. Option E is correct because SSL Forward Proxy decryption requires the firewall to re-sign the server certificate with its own CA; for clients to trust this re-signed certificate and avoid certificate errors, the firewall's forward-trust CA certificate must be installed in the trusted root store of all client devices. Option A is not a best practice because using a self-signed certificate for decryption causes trust errors on clients and does not provide a manageable, trusted CA chain. Option B is not a best practice because decrypting all internal server-to-server traffic is unnecessary, adds significant processing overhead, and can break applications that use certificate pinning or mutual TLS. Option D is not a best practice because decrypting all outbound traffic regardless of destination ignores privacy, compliance, and performance considerations, and traffic to sensitive categories should be excluded.

Answer

Use a self-signed certificate for decryption.

Answer

Decrypt all internal traffic including server-to-server.

Answer

Decrypt all outbound traffic regardless of destination.

Question 14

Which THREE of the following are valid actions for a decryption policy rule? (Choose three.)

Accepted Answer

No Decrypt. In a Palo Alto Networks decryption policy, the three valid rule actions are No Decrypt, Forward Untrust Certificate, and Decrypt. Option A (No Decrypt) is correct because it allows specified traffic to bypass decryption entirely, which is used for traffic that cannot or should not be decrypted, such as pinned or sensitive sessions. Option B (Forward Untrust Certificate) is correct because it is a specific decryption action that presents the firewall's untrust certificate to clients when the destination server certificate is not trusted, enabling continued inspection. Option E (Decrypt) is correct because it is the primary action that instructs the firewall to decrypt and inspect matching SSL/TLS traffic. Options C (Block) and D (Forward) are not valid decryption policy actions; Block is a security policy action, and Forward is not a decryption rule action in this context.

Answer

Block

Answer

Forward

Question 15

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

Accepted Answer

No Decrypt (bypass decryption). The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.

Answer

Error due to rule conflict

Answer

Block

Answer

Decrypt