PCNSA Decryption and Monitoring Practice Test 5 — 15 Questions

Question 1

A decryption policy is configured to decrypt traffic to a specific external server. The admin notices that the traffic is not being decrypted. What is the first step in troubleshooting?

Accepted Answer

Check the traffic log to see if the policy is matched. The first step in troubleshooting a decryption policy that is not decrypting traffic is to check the traffic log to confirm whether the policy is actually being matched. If the traffic does not match the decryption rule, no decryption will occur regardless of certificate validity or other settings. This aligns with the systematic troubleshooting approach of verifying policy application before investigating deeper configuration issues.

Answer

Verify that the decryption certificate is valid

Answer

Disable the SSL/TLS service profile

Answer

Ensure that the server's certificate is imported

Question 2

Which THREE factors should be considered when deciding which traffic to decrypt? (Select exactly three.)

Accepted Answer

Privacy regulations. Privacy regulations such as GDPR, HIPAA, or PCI DSS often restrict the decryption of traffic containing personally identifiable information (PII) or protected health information (PHI). Decrypting such traffic without proper safeguards can lead to legal penalties and data breach exposure. Palo Alto Networks firewalls can apply decryption policies that exclude traffic to specific URL categories or IP ranges to remain compliant with these regulations.

Answer

The cost of SSL certificates

Answer

User productivity

Question 3

Which TWO logs are most useful for troubleshooting SSL decryption issues? (Select exactly two.)

Accepted Answer

System log. The System log (B) records decryption-related events, such as certificate validation failures, handshake errors, and unsupported cipher suites, which are critical for diagnosing SSL decryption issues. The Traffic log (D) shows whether traffic was decrypted or bypassed, including the 'Decrypted' flag and details about the SSL/TLS handshake, allowing you to verify decryption policy application.

Answer

GlobalProtect log

Answer

Threat log

Answer

URL Filtering log

Question 4

Refer to the exhibit. The firewall raises a certificate expiry warning for the decryption CA. Which action is required?

Accepted Answer

Renew the decryption CA certificate before expiry. The decryption CA certificate is used by the firewall to generate and sign internal server certificates for SSL decryption. When it expires, the firewall can no longer create new decryption certificates, causing SSL decryption to fail for new sessions. Renewing the decryption CA certificate before expiry ensures uninterrupted decryption and avoids certificate validation errors for clients.

Answer

Ignore the warning as it is only informational

Answer

Import a new server certificate

Answer

Disable decryption until renewal

Question 5

Refer to the exhibit. A decryption policy has two rules. Traffic destined to a web server is not being decrypted. What is the most likely cause?

Accepted Answer

The Default-No-Decrypt rule is above Decrypt-Web and matches all traffic. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If the 'Default-No-Decrypt' rule is placed above the 'Decrypt-Web' rule and matches all traffic (e.g., source/destination 'any'), then all traffic, including traffic to the web server, will match this rule first and will not be decrypted, preventing the 'Decrypt-Web' rule from ever being evaluated.

Answer

The 'strict' profile is misconfigured

Answer

The Decrypt-Web rule has a profile that blocks decryption

Answer

The source is set to 'any' in the Decrypt-Web rule

Question 6

Refer to the exhibit. A firewall log shows a decryption failure for a session. What is the most probable cause?

Accepted Answer

The firewall's system time is ahead of the certificate's validity start. When the firewall's system time is ahead of the certificate's validity start (the 'not before' date), the firewall considers the certificate as not yet valid. During SSL/TLS decryption, the firewall validates the server certificate's time constraints against its own system clock. If the firewall's clock is ahead, the certificate appears to be from the future, causing a decryption failure even though the server and client clocks may be correct.

Answer

The server's certificate is expired

Answer

The decryption profile rejects self-signed certificates

Answer

The client's system time is behind

Question 7

A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?

Accepted Answer

The firewall's decryption certificate is not signed by the installed root CA.. In forward proxy decryption, the firewall generates a decryption certificate that must be signed by the trusted root CA installed on the endpoints. If the decryption certificate is self-signed or signed by a different CA, the browser will not trust it, causing certificate errors. The root CA certificate must be installed on all endpoints to establish a chain of trust for the firewall-generated certificates.

Answer

The decryption profile is set to block sessions with untrusted certificates.

Answer

The firewall is performing inbound inspection instead of forward proxy.

Answer

No decryption profile is attached to the decryption rule.

Question 8

A network administrator notices that some HTTPS sessions are not being decrypted by the firewall, even though the decryption policy rule is configured to decrypt traffic from a specific subnet. The firewall is in forward proxy mode. All other decryption rules work. What is the most likely cause?

Accepted Answer

A no-decrypt rule higher in the policy list matches the traffic before the decrypt rule.. In a forward proxy deployment, the firewall evaluates decryption policy rules in order from top to bottom. If a no-decrypt rule is placed higher in the policy list than the decrypt rule for the specific subnet, traffic matching that no-decrypt rule will bypass decryption entirely. This is the most likely cause because all other decryption rules work, indicating the decryption configuration itself is functional, but the order of rule evaluation prevents the intended rule from being applied.

Answer

The traffic is using TLS 1.3 which is not supported by the firewall.

Answer

The firewall's encryption algorithm settings do not match the server's cipher suite.

Answer

The SSL/TLS decryption profile has 'Block sessions with expired certificates' enabled.

Question 9

A security team wants to inspect traffic to and from a critical application server. They configure an inbound decryption rule to decrypt traffic destined to the server's IP address. After deploying, they find that traffic is not being decrypted. What is the first step to troubleshoot?

Accepted Answer

Check the decryption policy rule order and ensure it is before any no-decrypt rules.. In Palo Alto Networks firewalls, decryption policy rules are evaluated in order from top to bottom, and the first matching rule is applied. If a 'no-decrypt' rule appears before the inbound decryption rule, traffic matching the server's IP will be handled by the no-decrypt rule and will not be decrypted. Therefore, verifying rule order is the first troubleshooting step.

Answer

Confirm that the decryption profile is set to 'decrypt' and that the forward proxy option is enabled.

Answer

Verify that the server's certificate is installed on the firewall.

Answer

Ensure that the firewall has a valid certificate for inbound inspection.

Question 10

A Palo Alto firewall administrator wants to monitor SSL decryption efficiency. Which log type provides the most detailed information about decryption actions and reasons for not decrypting?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record detailed information about SSL decryption actions, including whether traffic was decrypted, not decrypted, or bypassed, along with the exact reason (e.g., unsupported cipher, certificate mismatch, excluded category). This granularity is essential for monitoring decryption efficiency and troubleshooting decryption policies.

Answer

System logs

Answer

Traffic logs

Answer

Threat logs

Question 11

An organization is using outbound SSL decryption with a forward proxy. They notice that mobile devices (iOS/Android) are having trouble connecting to many HTTPS sites after decryption is enabled. IT has installed the root CA certificate on all devices. What is the most likely reason?

Accepted Answer

The root CA certificate is not trusted by mobile OS due to certificate transparency or pinning.. Mobile operating systems (iOS and Android) implement certificate transparency (CT) requirements and certificate pinning for many HTTPS sites. Even if the root CA certificate is installed, the firewall's decryption certificate is not logged in public CT logs, causing the OS to reject the connection. Additionally, pinned certificates (e.g., for Google or Apple services) will fail validation when the firewall presents its own certificate instead of the original server certificate.

Answer

The decryption profile does not allow TLS 1.3 connections.

Answer

The firewall's decryption certificate uses a weak key length.

Answer

The firewall is not configured to decrypt traffic from mobile devices.

Question 12

An administrator is troubleshooting decryption-related connectivity issues. Which two log types should be examined to gather information about decryption actions and errors?

Accepted Answer

Decryption logs. Decryption logs are specifically designed to record details about SSL/TLS decryption actions, including handshake failures, certificate validation errors, and decryption policy matches. When troubleshooting connectivity issues related to decryption, these logs provide the most direct insight into why a session might be blocked or failing due to decryption errors.

Answer

System logs

Answer

URL Filtering logs

Answer

Threat logs

Question 13

During SSL decryption, which three factors can cause the firewall to fail to decrypt a session or to bypass decryption?

Accepted Answer

The decryption rule has a schedule that is not currently active.. A decryption rule with a schedule that is not currently active will not apply, causing the firewall to bypass decryption for the matching traffic. The firewall checks the schedule before attempting decryption, and if the schedule is inactive, the rule is effectively disabled, leading to a bypass.

Answer

The SSH protocol is being used instead of SSL/TLS.

Answer

The firewall's decryption hardware accelerator is faulty.

Question 14

A security analyst needs to monitor decryption performance and identify sessions that are bypassing decryption due to policy or technical reasons. Which two monitoring tools or methods can provide this insight?

Accepted Answer

Decryption logs with filter 'decryption action not equal to decrypt'. Decryption logs with a filter for 'decryption action not equal to decrypt' will show sessions that were not decrypted, including those bypassed due to policy (e.g., excluded URLs) or technical reasons (e.g., unsupported cipher suites). Option C is correct because the ACC > Decryption Overview provides a dashboard that visualizes decryption performance metrics, such as the number of sessions bypassed, decrypted, or failed, giving the analyst a high-level view of bypass activity.

Answer

System logs with filter 'decryption bypass'

Answer

Traffic logs with filter 'action equals decrypt' and 'reason equals bypass'

Answer

Packet capture on the decryption port

Question 15

A hospital network uses a Palo Alto Networks firewall with outbound SSL decryption. The IT security team notices that during peak hours, the firewall CPU utilization spikes to 95% when decryption is enabled, causing latency for all users. They have already upgraded to maximum licensed throughput and added a dedicated decryption engine. However, the issue persists. The network has 10,000 endpoints and 500 Mbps throughput. The decryption policy includes rules to decrypt all traffic to critical medical cloud services (EHR, PACS) and social media sites. What should the administrator do first to reduce CPU load?

Accepted Answer

Create a more specific decryption policy to only decrypt necessary traffic.. The firewall is decrypting unnecessary traffic (social media sites) in addition to critical medical cloud services. By refining the decryption policy to exclude non-essential traffic, the administrator reduces the CPU load from SSL/TLS handshake and encryption processing, directly addressing the spike without requiring hardware changes. This aligns with Palo Alto Networks best practices of minimizing decryption scope to only traffic that requires inspection.

Answer

Increase the decryption session timeout value.

Answer

Replace the firewall with a higher-end model.

Answer

Enable SSL acceleration hardware offloading.