PCNSA Decryption and Monitoring Practice Test 4 — 15 Questions

Question 1

A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?

Accepted Answer

The firewall's decryption certificate is not signed by the installed root CA.. Option C is correct because in forward proxy decryption, the firewall generates a decryption certificate that must be signed by the trusted root CA installed on the endpoints. If the decryption certificate is self-signed or signed by a different CA, the browser will not trust it, causing certificate errors. The root CA certificate must be installed on all endpoints to establish a chain of trust for the firewall-generated certificates.

Answer

The decryption profile is set to block sessions with untrusted certificates.

Answer

The firewall is performing inbound inspection instead of forward proxy.

Answer

No decryption profile is attached to the decryption rule.

Question 2

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

Accepted Answer

A no-decrypt rule higher in the policy list matches the traffic before the decrypt rule.. In a forward proxy deployment, the firewall evaluates decryption policy rules in order from top to bottom. If a no-decrypt rule is placed higher in the policy list than the decrypt rule for the specific subnet, traffic matching that no-decrypt rule will bypass decryption entirely. This is the most likely cause because all other decryption rules work, indicating the decryption configuration itself is functional, but the order of rule evaluation prevents the intended rule from being applied.

Answer

The traffic is using TLS 1.3 which is not supported by the firewall.

Answer

The firewall's encryption algorithm settings do not match the server's cipher suite.

Answer

The SSL/TLS decryption profile has 'Block sessions with expired certificates' enabled.

Question 3

A security team wants to inspect traffic to and from a critical application server. They configure an inbound decryption rule to decrypt traffic destined to the server's IP address. After deploying, they find that traffic is not being decrypted. What is the first step to troubleshoot?

Accepted Answer

Check the decryption policy rule order and ensure it is before any no-decrypt rules.. Option B is correct because in Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If a 'no-decrypt' rule appears before the inbound decryption rule, traffic matching the server's IP will be handled by the no-decrypt rule and will not be decrypted. Therefore, verifying rule order is the first troubleshooting step.

Answer

Confirm that the decryption profile is set to 'decrypt' and that the forward proxy option is enabled.

Answer

Verify that the server's certificate is installed on the firewall.

Answer

Ensure that the firewall has a valid certificate for inbound inspection.

Question 4

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 5

After enabling SSL decryption, users report that some websites fail to load. The firewall logs show 'decryption error' for these sites. Which decryption profile setting should the administrator check first?

Accepted Answer

Block sessions with untrusted issuers. When SSL decryption is enabled, the firewall acts as a man-in-the-middle and must re-sign the server's certificate with its own CA. If the server's certificate is issued by an untrusted CA (i.e., not in the firewall's trusted CA list), the firewall cannot verify the chain of trust and will block the session if the 'Block sessions with untrusted issuers' option is enabled. This is the most common cause of 'decryption error' logs for sites that previously worked without decryption.

Answer

Block sessions with expired certificates

Answer

Block sessions with certificate status unknown

Answer

Block sessions with unsupported cipher suites

Question 6

An organization is using outbound SSL decryption with a forward proxy. They notice that mobile devices (iOS/Android) are having trouble connecting to many HTTPS sites after decryption is enabled. IT has installed the root CA certificate on all devices. What is the most likely reason?

Accepted Answer

The root CA certificate is not trusted by mobile OS due to certificate transparency or pinning.. Option C is correct because mobile operating systems (iOS and Android) implement certificate transparency (CT) requirements and certificate pinning for many HTTPS sites. Even if the root CA certificate is installed, the firewall's decryption certificate is not logged in public CT logs, causing the OS to reject the connection. Additionally, pinned certificates (e.g., for Google or Apple services) will fail validation when the firewall presents its own certificate instead of the original server certificate.

Answer

The decryption profile does not allow TLS 1.3 connections.

Answer

The firewall's decryption certificate uses a weak key length.

Answer

The firewall is not configured to decrypt traffic from mobile devices.

Question 7

An administrator is troubleshooting decryption-related connectivity issues. Which two log types should be examined to gather information about decryption actions and errors?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record details about SSL/TLS decryption actions, including handshake failures, certificate validation errors, and decryption policy matches. When troubleshooting connectivity issues related to decryption, these logs provide the most direct insight into why a session might be blocked or failing due to decryption errors.

Answer

System logs

Answer

URL Filtering logs

Answer

Threat logs

Question 8

During SSL decryption, which three factors can cause the firewall to fail to decrypt a session or to bypass decryption?

Accepted Answer

The decryption rule has a schedule that is not currently active.. Option A is correct because a decryption rule with a schedule that is not currently active will not apply, causing the firewall to bypass decryption for the matching traffic. The firewall checks the schedule before attempting decryption, and if the schedule is inactive, the rule is effectively disabled, leading to a bypass.

Answer

The SSH protocol is being used instead of SSL/TLS.

Answer

The firewall's decryption hardware accelerator is faulty.

Question 9

A security analyst needs to monitor decryption performance and identify sessions that are bypassing decryption due to policy or technical reasons. Which two monitoring tools or methods can provide this insight?

Accepted Answer

Decryption logs with filter 'decryption action not equal to decrypt'. Option A is correct because decryption logs with a filter for 'decryption action not equal to decrypt' will show sessions that were not decrypted, including those bypassed due to policy (e.g., excluded URLs) or technical reasons (e.g., unsupported cipher suites). Option C is correct because the ACC > Decryption Overview provides a dashboard that visualizes decryption performance metrics, such as the number of sessions bypassed, decrypted, or failed, giving the analyst a high-level view of bypass activity.

Answer

System logs with filter 'decryption bypass'

Answer

Traffic logs with filter 'action equals decrypt' and 'reason equals bypass'

Answer

Packet capture on the decryption port

Question 10

A hospital network uses a Palo Alto Networks firewall with outbound SSL decryption. The IT security team notices that during peak hours, the firewall CPU utilization spikes to 95% when decryption is enabled, causing latency for all users. They have already upgraded to maximum licensed throughput and added a dedicated decryption engine. However, the issue persists. The network has 10,000 endpoints and 500 Mbps throughput. The decryption policy includes rules to decrypt all traffic to critical medical cloud services (EHR, PACS) and social media sites. What should the administrator do first to reduce CPU load?

Accepted Answer

Create a more specific decryption policy to only decrypt necessary traffic.. The correct answer is A because the firewall is decrypting unnecessary traffic (social media sites) in addition to critical medical cloud services. By refining the decryption policy to exclude non-essential traffic, the administrator reduces the CPU load from SSL/TLS handshake and encryption processing, directly addressing the spike without requiring hardware changes. This aligns with Palo Alto Networks best practices of minimizing decryption scope to only traffic that requires inspection.

Answer

Increase the decryption session timeout value.

Answer

Replace the firewall with a higher-end model.

Answer

Enable SSL acceleration hardware offloading.

Question 11

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

Accepted Answer

The decryption rule is configured with the forward proxy method.. Option D is correct because inbound SSL decryption requires the 'SSL Inbound Inspection' method, not the forward proxy method. Forward proxy is used for outbound decryption where the firewall generates a certificate on the fly. For inbound decryption, the firewall must use the server's private key to decrypt traffic, which is configured via an SSL Inbound Inspection rule. Since the rule is set to forward proxy, the firewall attempts to re-encrypt with its own certificate, causing a certificate mismatch and the 'secure connection' error.

Answer

The firewall does not support wildcard certificates for inbound decryption.

Answer

The web server is not properly configured to handle decrypted traffic.

Answer

The decryption profile is set to 'Block sessions with untrusted certificates'.

Question 12

A university uses a Palo Alto firewall for outbound SSL decryption. The IT helpdesk receives complaints that students cannot access certain educational resource websites (e.g., online libraries, research databases) after decryption was enabled. The firewall logs show 'decryption failure' for these sites with reason 'certificate validation failure'. The decryption profile is set to 'Block sessions with expired certificates' and 'Block sessions with untrusted issuers'. The helpdesk verifies that the root CA certificate is installed on all endpoints. The issue is intermittent and only affects a few sites. What should the administrator do?

Accepted Answer

Use a decryption profile that allows sessions with certificate status unknown.. The correct answer is D because the 'decryption failure' with 'certificate validation failure' and 'certificate status unknown' indicates that the firewall cannot determine the revocation status of the site's certificate (e.g., no CRL or OCSP responder reachable). The current decryption profile blocks sessions with expired certificates and untrusted issuers, but it does not explicitly block sessions with 'certificate status unknown'. By using a decryption profile that allows sessions with certificate status unknown, the firewall will permit the SSL handshake to proceed even when revocation checking fails, resolving the intermittent access issues for those specific educational sites.

Answer

Update the firewall's certificate revocation list (CRL).

Answer

Add the websites to a decryption policy exception rule.

Answer

Disable blocking for untrusted issuers in the decryption profile.

Question 13

A company has a Palo Alto firewall with both inbound and outbound decryption. The security team notices that some traffic to a specific internal server is being double-decrypted: first by inbound decryption when the client is internal, and second by outbound decryption when the server initiates connections to external resources. This causes performance issues and certificate warnings. The firewall policy has separate rules for inbound and outbound decryption, and all internal traffic passes through the firewall. How should the administrator resolve this?

Accepted Answer

Ensure that the inbound decryption rule only applies to traffic from external sources, not internal.. The core issue is that inbound decryption is incorrectly applied to traffic from internal clients to the internal server, causing double decryption when the server subsequently initiates outbound connections. By ensuring the inbound decryption rule only applies to traffic from external sources (i.e., source zone is untrust), internal-to-internal traffic bypasses inbound decryption, eliminating the double-decryption loop. This aligns with best practices where inbound decryption is scoped to traffic originating outside the network.

Answer

Create a decryption exclusion rule for traffic between internal clients and the internal server.

Answer

Disable outbound decryption for the subnet of the internal server.

Answer

Use a no-decrypt rule for traffic from the internal server's IP to the internet.

Question 14

Refer to the exhibit. An administrator notices a high number of decryption failures. What is the most likely cause?

Accepted Answer

The firewall's certificate is not trusted by client devices.. When the firewall's certificate is not trusted by client devices, clients will reject the SSL handshake, resulting in decryption failures. This is a common issue in SSL Forward Proxy deployments where the firewall generates a certificate for each session, and clients must trust the firewall's CA certificate. Without this trust, clients display certificate warnings or fail to connect, leading to a high number of decryption failures.

Answer

The SSL session cache size is too small.

Answer

SSL Forward Proxy is not enabled.

Answer

Non-HTTP traffic is being decrypted.

Question 15

Which TWO actions are recommended for monitoring decrypted traffic on a Palo Alto Networks firewall?

Accepted Answer

Create an ACC filter for decrypted sessions.. Option B is correct because the ACC (Application Command Center) filter for decrypted sessions allows you to visualize and monitor decrypted traffic in real time, providing insights into applications, threats, and URLs within those sessions. Option D is correct because enabling logging on decryption policies ensures that decrypted session details are recorded in the decryption log, which is essential for auditing and troubleshooting decrypted traffic.

Answer

Disable decryption during peak hours.

Answer

Use the 'decryption' log type.

Answer

Export decrypted traffic to a log collector.