PCNSA Decryption and Monitoring Practice Test 4 — 15 Questions

Question 1

A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.. It creates a decryption policy rule with action 'No Decrypt' for the specific URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule. This ensures that traffic to these sensitive categories is excluded from SSL Forward Proxy decryption, resolving the loading issues caused by certificate pinning or regulatory violations, while still decrypting all other student traffic. The rule order is critical because Palo Alto Networks decryption policies are evaluated top-down, and the first match determines the action.

Answer

Modify the existing decrypt rule to decrypt all categories except those two.

Answer

Disable decryption entirely for all student traffic.

Answer

Create a security policy rule to allow traffic to those URL categories without inspection.

Question 2

A security administrator needs to inspect traffic to a critical web server that uses HTTPS. The firewall is configured as a forward proxy for outbound traffic. Which decryption type should be used to decrypt the traffic inbound to the web server?

Accepted Answer

Inbound Inspection Decryption. Inbound Inspection Decryption is used to decrypt traffic destined to a protected server, such as a web server using HTTPS. In this scenario, the firewall acts as a reverse proxy, intercepting inbound connections to the server and decrypting them for inspection before re-encrypting and forwarding the traffic. This allows the security administrator to inspect the payload of HTTPS traffic without requiring client-side configuration.

Answer

Decryption Mirror

Answer

Outbound (Forward Proxy) Decryption

Answer

SSH Proxy

Question 3

A company wants to decrypt all SSL/TLS traffic from internal users except traffic to financial sites. The firewall is placed as a forward proxy. Which policy configuration ensures that traffic to financial sites is not decrypted?

Accepted Answer

Create a decryption policy with action 'no-decrypt' for traffic to financial sites, and a catch-all decryption policy with action 'decrypt' for all other traffic.. It uses a specific 'no-decrypt' action in a decryption policy for financial sites, which explicitly excludes them from SSL/TLS decryption. A catch-all policy with 'decrypt' then ensures all other internal user traffic is decrypted. This approach directly aligns with the forward proxy requirement to decrypt all traffic except the specified financial sites.

Answer

Create a decryption policy and use the 'exclude cache' option for financial sites.

Answer

Create a security policy that allows financial sites without decryption; then create a decryption policy with action 'no-decrypt' for those sites.

Answer

Create a decryption policy with action 'decrypt' and a source zone of internal; then create a decryption exemption for financial URLs.

Question 4

A firewall is configured for inbound inspection decryption. Which certificate must be installed on the firewall for this to work?

Accepted Answer

The server's certificate and private key.. Inbound inspection decryption requires the firewall to act as a TLS proxy, intercepting and decrypting traffic destined for a protected server. To do this, the firewall must possess the server's certificate and its corresponding private key, allowing it to terminate the TLS connection from the client and re-encrypt traffic to the server. Without the private key, the firewall cannot decrypt the session.

Answer

The client's certificate.

Answer

A trusted CA certificate from the enterprise PKI.

Answer

The firewall's own self-signed certificate.

Question 5

A network administrator wants to monitor HTTPS traffic without decrypting it, but still wants to identify the applications being used. Which feature can be used to identify HTTPS applications without decryption?

Accepted Answer

App-ID with SSL protocol detection. App-ID with SSL protocol detection allows the firewall to identify HTTPS applications by inspecting the Server Name Indication (SNI) field in the TLS handshake and the certificate common name, without decrypting the traffic. This enables application identification while preserving encryption, meeting the requirement to monitor HTTPS traffic without decryption.

Answer

SSL Decryption Mirror

Answer

SSL Forward Proxy

Answer

URL Filtering

Question 6

A firewall administrator notices that traffic from an internal user is being decrypted, but the user's browser shows a certificate warning. The firewall uses a CA certificate issued by the company's internal PKI. What is the most likely reason for the browser warning?

Accepted Answer

The firewall's root CA certificate is not installed in the user's browser trusted root store.. The browser warning indicates that the firewall's decrypted traffic is being signed with a certificate that the browser does not trust. When a firewall performs SSL/TLS decryption using a CA certificate from the company's internal PKI, the browser will only trust the decrypted connections if the root CA certificate of that PKI is installed in the browser's trusted root certificate store. Without this trust anchor, the browser cannot validate the certificate chain presented by the firewall, resulting in a certificate warning.

Answer

The decryption policy has the action 'decrypt' but no certificate profile.

Answer

The user's browser does not support TLS 1.2.

Answer

The server certificate is revoked.

Question 7

A firewall is configured to decrypt SSH traffic. Which type of decryption must be enabled?

Accepted Answer

SSH Proxy. SSH traffic uses its own encryption protocol, not SSL/TLS. To decrypt SSH traffic, the firewall must act as a man-in-the-middle using an SSH proxy, which terminates the client's SSH connection and establishes a separate SSH session with the server, allowing inspection of the plaintext content. This is distinct from SSL decryption methods.

Answer

SSL Forward Proxy

Answer

Inbound Inspection

Answer

Decryption Mirror

Question 8

A company wants to ensure that decryption policies are applied based on the user identity. The firewall is integrated with Active Directory. Which decryption policy matching criteria should be used?

Accepted Answer

Source user. Source user is correct because decryption policies based on user identity require matching the user information obtained from Active Directory integration. The firewall uses User-ID to map IP addresses to usernames, and the decryption policy can then enforce rules based on the source user.

Answer

URL category

Answer

Source zone

Answer

Source IP address

Question 9

A firewall is experiencing high CPU utilization due to SSL decryption. The administrator wants to reduce the load without completely disabling decryption. Which action should be taken?

Accepted Answer

Create a decryption bypass for traffic to high-bandwidth sites with low security risk.. Creating a decryption bypass for traffic to high-bandwidth, low-risk sites reduces the CPU load from SSL decryption by exempting that traffic from decryption, while still allowing decryption for higher-risk traffic. This targeted approach maintains security posture without completely disabling decryption, aligning with best practices for managing decryption resources on Palo Alto Networks firewalls.

Answer

Use decryption mirroring to offload decryption to a dedicated appliance.

Answer

Change decryption policy to 'no-decrypt' for all traffic.

Answer

Enable SSL/TLS protocol settings to disable weak ciphers.

Question 10

Which THREE actions can be performed in a decryption policy? (Choose three.)

Accepted Answer

No-decrypt. In a Palo Alto Networks decryption policy, the three supported actions are No-decrypt (C), Block (D), and Decrypt (E). No-decrypt (C) is correct because it lets traffic bypass decryption, which is used for traffic that cannot or should not be decrypted, such as pinned or unsupported cipher suites. Block (D) is correct because the policy can drop sessions outright, for example to enforce that certain categories or applications must be decrypted or denied. Decrypt (E) is correct because it is the core action that applies SSL/TLS decryption to matching sessions. App-ID (A) is not an action but a matching criterion/classification used in the policy rule, and Allow (B) is a security policy action, not a decryption policy action.

Answer

App-ID

Answer

Allow

Question 11

A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)

Accepted Answer

The firewall's root CA certificate deployed to client browsers. Option B is correct because forward proxy SSL decryption requires the firewall to act as a man-in-the-middle, which means clients must trust the firewall's root CA certificate; deploying it to client browsers allows them to validate the re-signed certificates without errors. Option D is correct because a decryption policy rule with action 'decrypt' is what actually instructs the firewall to intercept and decrypt matching sessions; without it, traffic is not decrypted. Option E is correct because the firewall needs a CA certificate installed on itself to sign the forged certificates it presents to clients during decryption. Option A is not required because the server's private key is never needed for forward proxy decryption; the firewall generates its own certificates signed by its CA. Option C is not a required component for decryption to function, since decryption is governed by the decryption policy, not a security policy rule allowing decrypted traffic.

Answer

The server's private key

Answer

A security policy rule allowing decrypted traffic

Question 12

A company uses forward proxy decryption. A user cannot access an HTTPS site. The decryption policy is configured with the default SSL/TLS service profile. What is the most likely issue?

Accepted Answer

The firewall's certificate is not trusted by the client. When forward proxy decryption is used, the firewall generates a new certificate on-the-fly to sign the decrypted traffic. If the firewall's certificate is not trusted by the client (i.e., not installed in the client's trusted root certificate store), the browser will display a certificate warning and block access to the HTTPS site. The default SSL/TLS service profile uses the firewall's own CA certificate, which must be distributed to all clients for seamless decryption.

Answer

The decryption policy is set to no-decrypt

Answer

The certificate revocation check fails

Answer

The server certificate is self-signed

Question 13

A security administrator wants to inspect decrypted traffic for threats. What is the minimum set of features required?

Accepted Answer

SSL Decryption and Threat Prevention. To inspect decrypted traffic for threats, you must first decrypt the traffic using SSL Decryption, which terminates the SSL/TLS session and allows the firewall to examine the plaintext payload. Then, Threat Prevention (which includes IPS, antivirus, and anti-spyware signatures) can analyze that decrypted content for malicious patterns. Without SSL Decryption, Threat Prevention only sees encrypted traffic and cannot inspect the payload; without Threat Prevention, SSL Decryption alone provides no threat detection. Therefore, both features are required.

Answer

Threat Prevention only

Answer

SSL Decryption only

Answer

SSL Decryption and URL Filtering

Question 14

A company has a decryption policy that decrypts all traffic except for traffic to financial sites. However, users report that some financial sites are still being decrypted. What should the admin check first?

Accepted Answer

The decryption policy rule order. The decryption policy is evaluated in order from top to bottom, and the first matching rule is applied. If a rule that decrypts traffic is placed above the rule that excludes financial sites, traffic to those sites will be decrypted before reaching the exclusion rule. The admin should check the rule order to ensure the financial site exclusion rule is positioned above any decrypting rules.

Answer

The firewall's system logs

Answer

The certificate revocation status

Answer

The SSL/TLS service profile settings

Question 15

A firewall is configured with decryption and a custom SSL/TLS service profile that has 'Block Expired Certificates' enabled. After renewing a server certificate, some users are unable to access the site. The server certificate is correctly installed. What could be the issue?

Accepted Answer

The firewall's system clock is not synchronized. When 'Block Expired Certificates' is enabled in a custom SSL/TLS service profile, the firewall checks the validity period of the server certificate against its own system clock. If the firewall's clock is not synchronized (e.g., via NTP) and is set to a time outside the new certificate's validity window, the firewall will incorrectly treat the valid renewed certificate as expired and block the connection. This explains why users cannot access the site despite the server certificate being correctly installed.

Answer

The renewal caused a private key mismatch

Answer

The client's system clock is not synchronized

Answer

The decryption policy still points to the old certificate