PCNSA Decryption and Monitoring Practice Test 3 — 15 Questions

Question 1

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Accepted Answer

The firewall's certificate is not trusted by the client. When forward proxy decryption is used, the firewall generates a new certificate on-the-fly to sign the decrypted traffic. If the firewall's certificate is not trusted by the client (i.e., not installed in the client's trusted root certificate store), the browser will display a certificate warning and block access to the HTTPS site. The default SSL/TLS service profile uses the firewall's own CA certificate, which must be distributed to all clients for seamless decryption.

Answer

The decryption policy is set to no-decrypt

Answer

The certificate revocation check fails

Answer

The server certificate is self-signed

Question 2

An admin notices that decryption is failing for some sites with error 'SSL Handshake Failed' in the traffic log. The decryption policy uses a custom SSL/TLS service profile with 'Allow Self-Signed Certificates' enabled. The firewall's certificate was issued by an internal CA. What should the admin check first?

Accepted Answer

The server certificate chain is invalid. The error 'SSL Handshake Failed' typically indicates a problem with the server certificate chain, such as an intermediate CA certificate missing or an untrusted root. Even with 'Allow Self-Signed Certificates' enabled, the firewall must validate the entire certificate chain for forward decryption; if the chain is invalid or incomplete, the handshake fails. The admin should first verify that the server's certificate chain is complete and trusted by the firewall's certificate store.

Answer

The firewall's certificate is expired

Answer

The decryption policy's action is set to 'decrypt'

Answer

The client is using an outdated browser

Question 3

An organization uses inbound inspection decryption for their public-facing web servers. They have imported the server's certificate and private key into the firewall. However, some clients report 'untrusted certificate' warnings. What is the most likely cause?

Accepted Answer

The firewall is not configured with the root CA certificate. When a firewall performs inbound inspection decryption, it re-encrypts traffic using the server's certificate. If the firewall does not have the root CA certificate that issued the server's certificate, the firewall cannot present a complete certificate chain to clients. Clients then see the certificate as untrusted because the issuing CA is not recognized, even though the server's certificate and private key are correctly imported.

Answer

The server's certificate is using an unsupported cipher

Answer

The decryption profile's 'Unsupported Modes' is set to 'Block'

Answer

The decryption policy is not matching the traffic

Question 4

A security administrator wants to inspect decrypted traffic for threats. What is the minimum set of features required?

Accepted Answer

SSL Decryption and Threat Prevention. To inspect decrypted traffic for threats, you must first decrypt the traffic using SSL Decryption, which terminates the SSL/TLS session and allows the firewall to examine the plaintext payload. Then, Threat Prevention (which includes IPS, antivirus, and anti-spyware signatures) can analyze that decrypted content for malicious patterns. Without SSL Decryption, Threat Prevention only sees encrypted traffic and cannot inspect the payload; without Threat Prevention, SSL Decryption alone provides no threat detection. Therefore, both features are required.

Answer

Threat Prevention only

Answer

SSL Decryption only

Answer

SSL Decryption and URL Filtering

Question 5

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Accepted Answer

The decryption policy rule order. The decryption policy is evaluated in order from top to bottom, and the first matching rule is applied. If a rule that decrypts traffic is placed above the rule that excludes financial sites, traffic to those sites will be decrypted before reaching the exclusion rule. The admin should check the rule order to ensure the financial site exclusion rule is positioned above any decrypting rules.

Answer

The firewall's system logs

Answer

The certificate revocation status

Answer

The SSL/TLS service profile settings

Question 6

A firewall is configured with decryption and a custom SSL/TLS service profile that has 'Block Expired Certificates' enabled. After renewing a server certificate, some users are unable to access the site. The server certificate is correctly installed. What could be the issue?

Accepted Answer

The firewall's system clock is not synchronized. When 'Block Expired Certificates' is enabled in a custom SSL/TLS service profile, the firewall checks the validity period of the server certificate against its own system clock. If the firewall's clock is not synchronized (e.g., via NTP) and is set to a time outside the new certificate's validity window, the firewall will incorrectly treat the valid renewed certificate as expired and block the connection. This explains why users cannot access the site despite the server certificate being correctly installed.

Answer

The renewal caused a private key mismatch

Answer

The client's system clock is not synchronized

Answer

The decryption policy still points to the old certificate

Question 7

An administrator wants to view logs related to decryption failures. Which log type should they use?

Accepted Answer

Traffic logs. Traffic logs capture all session-level events, including decryption failures, because they record the action taken by the firewall (e.g., 'decrypt', 'no-decrypt', or 'decrypt-error'). When decryption fails due to issues like certificate validation errors, unsupported cipher suites, or handshake failures, the firewall logs the session as a traffic log entry with a specific reason code. This makes Traffic logs the correct source for troubleshooting decryption failures.

Answer

Threat logs

Answer

URL Filtering logs

Answer

System logs

Question 8

A decryption policy is configured to decrypt traffic to a specific external server. The admin notices that the traffic is not being decrypted. What is the first step in troubleshooting?

Accepted Answer

Check the traffic log to see if the policy is matched. The first step in troubleshooting a decryption policy that is not decrypting traffic is to check the traffic log to confirm whether the policy is actually being matched. If the traffic does not match the decryption rule, no decryption will occur regardless of certificate validity or other settings. This aligns with the systematic troubleshooting approach of verifying policy application before investigating deeper configuration issues.

Answer

Verify that the decryption certificate is valid

Answer

Disable the SSL/TLS service profile

Answer

Ensure that the server's certificate is imported

Question 9

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Accepted Answer

The firewall is not configured to forward client certificates. SSL Forward Proxy decryption intercepts and re-encrypts traffic, which strips the original client certificate from the TLS handshake. For internal applications that require client certificate authentication, the firewall must be explicitly configured to forward the client certificate to the destination server. Without this forwarding, the server never receives the certificate, causing authentication failures.

Answer

The SSL/TLS service profile does not allow self-signed certificates

Answer

The decryption profile's 'Block Unsupported Modes' is enabled

Answer

The decryption policy is set to 'decrypt' but not 'proxy'

Question 10

Which TWO actions should be taken when configuring SSL Forward Proxy decryption? (Select exactly two.)

Accepted Answer

Generate or import a CA certificate for the firewall. SSL Forward Proxy decryption requires the firewall to act as a trusted intermediary. To do this, the firewall must generate or import a CA certificate that client browsers will trust, allowing it to dynamically generate and sign server certificates for decrypted sessions. Without this CA certificate, clients will receive untrusted certificate warnings, and decryption will fail.

Answer

Import the server's private key

Answer

Import the server certificate

Answer

Enable SSH decryption

Question 11

Which THREE factors should be considered when deciding which traffic to decrypt? (Select exactly three.)

Accepted Answer

Privacy regulations. Privacy regulations such as GDPR, HIPAA, or PCI DSS often restrict the decryption of traffic containing personally identifiable information (PII) or protected health information (PHI). Decrypting such traffic without proper safeguards can lead to legal penalties and data breach exposure. Palo Alto Networks firewalls can apply decryption policies that exclude traffic to specific URL categories or IP ranges to remain compliant with these regulations.

Answer

The cost of SSL certificates

Answer

User productivity

Question 12

Which TWO logs are most useful for troubleshooting SSL decryption issues? (Select exactly two.)

Accepted Answer

System log. The System log (B) records decryption-related events, such as certificate validation failures, handshake errors, and unsupported cipher suites, which are critical for diagnosing SSL decryption issues. The Traffic log (D) shows whether traffic was decrypted or bypassed, including the 'Decrypted' flag and details about the SSL/TLS handshake, allowing you to verify decryption policy application.

Answer

GlobalProtect log

Answer

Threat log

Answer

URL Filtering log

Question 13

Refer to the exhibit. The firewall raises a certificate expiry warning for the decryption CA. Which action is required?

Accepted Answer

Renew the decryption CA certificate before expiry. The decryption CA certificate is used by the firewall to generate and sign internal server certificates for SSL decryption. When it expires, the firewall can no longer create new decryption certificates, causing SSL decryption to fail for new sessions. Renewing the decryption CA certificate before expiry ensures uninterrupted decryption and avoids certificate validation errors for clients.

Answer

Ignore the warning as it is only informational

Answer

Import a new server certificate

Answer

Disable decryption until renewal

Question 14

Refer to the exhibit. A decryption policy has two rules. Traffic destined to a web server is not being decrypted. What is the most likely cause?

Accepted Answer

The Default-No-Decrypt rule is above Decrypt-Web and matches all traffic. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If the 'Default-No-Decrypt' rule is placed above the 'Decrypt-Web' rule and matches all traffic (e.g., source/destination 'any'), then all traffic, including traffic to the web server, will match this rule first and will not be decrypted, preventing the 'Decrypt-Web' rule from ever being evaluated.

Answer

The 'strict' profile is misconfigured

Answer

The Decrypt-Web rule has a profile that blocks decryption

Answer

The source is set to 'any' in the Decrypt-Web rule

Question 15

Refer to the exhibit. A firewall log shows a decryption failure for a session. What is the most probable cause?

Accepted Answer

The firewall's system time is ahead of the certificate's validity start. When the firewall's system time is ahead of the certificate's validity start (the 'not before' date), the firewall considers the certificate as not yet valid. During SSL/TLS decryption, the firewall validates the server certificate's time constraints against its own system clock. If the firewall's clock is ahead, the certificate appears to be from the future, causing a decryption failure even though the server and client clocks may be correct.

Answer

The server's certificate is expired

Answer

The decryption profile rejects self-signed certificates

Answer

The client's system time is behind