PCNSA Decryption and Monitoring — Timed 50 Questions

Question 1

A security engineer notices that HTTPS traffic to a critical business application is being decrypted and re-encrypted, causing performance issues. The application uses a certificate from a public CA. The engineer wants to minimize decryption overhead while still inspecting for threats. Which decryption policy configuration best achieves this?

50 minute time limit — choose an answer to begin.

Accepted Answer

Create a decryption policy rule with action 'No Decrypt' and enable 'Forward Trust Certificate' and 'Forward Untrust Certificate' with certificate status check.. Setting the action to 'No Decrypt' with a Forward Trust Certificate and Forward Untrust Certificate enabled, along with certificate status check, allows the firewall to validate the server certificate and forward the original encrypted traffic without decrypting it. This minimizes decryption overhead while still performing certificate inspection to detect threats like revoked or untrusted certificates, which is ideal for traffic from a public CA where decryption is not required for threat detection.

Answer

Create a decryption policy rule with action 'Decrypt' and a custom URL category for the application.

Answer

Create a decryption policy rule with action 'No Decrypt' and disable certificate status check.

Answer

Create a decryption policy rule with action 'Decrypt' and source zone set to 'Untrust'.

Question 2

A network administrator wants to monitor traffic that is not decrypted due to a 'No Decrypt' policy rule. Which log type would show that decryption was bypassed?

Accepted Answer

Tunnel Inspection logs. Tunnel Inspection logs are specifically designed to record traffic that bypasses decryption due to a 'No Decrypt' policy rule. When a decryption policy is set to 'No Decrypt', the firewall does not inspect the encrypted payload, but Tunnel Inspection logs capture metadata about the bypassed session, including the reason for bypass. This allows administrators to monitor and audit traffic that was not decrypted, ensuring visibility into policy exceptions.

Answer

URL Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 3

A company has a decryption policy that decrypts all outbound SSL traffic. Recently, users accessing a partner website receive a certificate warning. The partner uses a self-signed certificate. The firewall is configured with a CA-signed certificate for decryption. Which action should the firewall take?

Accepted Answer

The firewall will present the server's self-signed certificate to the client, causing a warning.. When a firewall is configured for SSL decryption with a CA-signed certificate, it acts as a man-in-the-middle. For outbound traffic to a server using a self-signed certificate, the firewall cannot validate the server's certificate against a trusted CA. It will present the server's self-signed certificate to the client, which the client's browser does not trust, causing a certificate warning.

Answer

The firewall will block the connection and generate an alert.

Answer

The firewall will decrypt the traffic using its own certificate and re-encrypt with the partner's certificate.

Answer

The firewall will automatically trust the self-signed certificate and pass traffic without decryption.

Question 4

Which monitoring tool in Palo Alto Networks firewall provides real-time visibility into decryption statistics, such as the number of sessions decrypted and certificate errors?

Accepted Answer

Dashboard. The Dashboard in Palo Alto Networks firewall provides real-time visibility into decryption statistics, including the number of sessions decrypted, certificate errors, and decryption failures. This is accessible via the 'Decryption' widget on the Dashboard, which aggregates live data from the decryption engine without requiring log queries or report generation.

Answer

Policy Optimizer

Answer

Log Viewer

Answer

Reports

Question 5

During a security audit, it is discovered that some internal hosts are using TLS 1.0, which is deprecated. The firewall is configured to decrypt SSL traffic. How can the administrator use the firewall to detect and report these connections without breaking them?

Accepted Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'alert'.. The firewall can decrypt TLS 1.0 traffic (action 'Decrypt') while using the 'TLS Version Check' feature set to 'alert' to detect and log the deprecated protocol without disrupting the connection. This allows the administrator to identify hosts using TLS 1.0 for reporting and remediation, while maintaining business continuity.

Answer

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Answer

Use a Security policy rule to block TLS 1.0 traffic.

Answer

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Question 6

Which TWO of the following are types of decryption supported by Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

SSL Forward Proxy. SSL Forward Proxy (B) is correct because it is a Palo Alto Networks decryption type where the firewall acts as a man-in-the-middle, intercepting outbound client SSL/TLS sessions, presenting its own certificate to the client, and establishing a separate session to the destination server to inspect traffic. SSL Inbound Inspection (C) is also correct because it is a supported decryption type in which the firewall decrypts traffic destined to an internal server using that server's own certificate and private key, typically for inbound connections from untrusted networks. The other options are not Palo Alto Networks decryption types: SSH Proxy (A) is not a supported decryption method (SSH is handled differently, e.g., via SSH proxy for auditing, not decryption), TLS 1.3 Decryption (D) is a protocol version capability rather than a decryption type, and SSL Reverse Proxy (E) is not a Palo Alto Networks decryption type (the correct inbound type is SSL Inbound Inspection).

Answer

SSH Proxy

Answer

TLS 1.3 Decryption

Answer

SSL Reverse Proxy

Question 7

Refer to the exhibit. An administrator notices a large number of decryption sessions. What is a valid conclusion based on the output?

Accepted Answer

There are a few sessions failing due to TLS version mismatch.. The exhibit shows decryption sessions with a 'TLS version mismatch' error, which indicates that the firewall is failing to establish a decryption session because the client and server are attempting to use different TLS versions (e.g., TLS 1.0 vs. TLS 1.2). This is a specific failure reason logged in the decryption session table, and the large number of such sessions confirms that many are failing due to this mismatch, not due to certificate errors or policy issues.

Answer

The firewall is rejecting many sessions due to certificate errors.

Answer

The decryption policy is not being hit because of low policy hits.

Answer

The current decryption session count is at its peak.

Question 8

A mid-sized enterprise has deployed a Palo Alto Networks firewall with SSL Forward Proxy decryption for outbound traffic. The firewall uses a CA-signed certificate from a public CA, and the certificate is installed on all corporate-managed endpoints. Recently, the security team noticed that a few users are unable to access a specific external SaaS application (app.example.com) over HTTPS. Other users can access it without issues. The firewall logs show that for these users, the session is being decrypted and no threat is detected. The application uses a valid certificate from a public CA. The affected users are in the same IP subnet and use the same browser version. Which is the most likely cause?

Accepted Answer

The firewall's CA certificate is not installed or trusted on the affected users' endpoints.. SSL Forward Proxy decryption requires the firewall to generate a new certificate on-the-fly for the destination server, signed by the firewall's own CA certificate. If the CA certificate is not trusted on the affected users' endpoints, the browser will display a certificate warning or block the connection entirely, even though the decryption policy is applied and no threats are detected. Since other users in the same subnet can access the application, the issue is isolated to the trust store on the affected machines, not the network or decryption policy.

Answer

The decryption policy is set to 'No Decrypt' for the affected users' source IP range.

Answer

The firewall is performing SSH proxy instead of SSL decryption for those users.

Answer

The SaaS application's certificate has expired for those users due to time zone differences.

Question 9

During troubleshooting, a firewall shows a large number of SSL decryption failures with error 'certificate_unknown'. The firewall is configured for forward proxy decryption. What is the most likely cause?

Accepted Answer

The firewall cannot reach the CRL or OCSP responder to validate the server certificate.. In forward proxy decryption, the firewall must validate the server certificate against a Certificate Revocation List (CRL) or via OCSP to ensure it hasn't been revoked. A 'certificate_unknown' error specifically indicates that the firewall cannot determine the revocation status of the server certificate, often because it cannot reach the CRL distribution point or OCSP responder. This is distinct from a certificate that is simply expired or untrusted by the client.

Answer

The client does not trust the firewall's CA certificate.

Answer

The server certificate is expired.

Answer

The decryption policy has an incorrect source zone.

Question 10

A security analyst is troubleshooting a decryption issue. Which TWO logs are most useful for identifying decryption failures? (Choose two.)

Accepted Answer

Traffic Logs. Traffic Logs (B) are most useful because they record the result of decryption actions, including whether decryption was applied and if it succeeded or failed, with specific error codes. Decryption Logs (E) are dedicated logs that capture detailed decryption events, such as handshake failures, certificate errors, or unsupported cipher suites, making them essential for troubleshooting decryption failures.

Answer

Config Logs

Answer

System Logs

Answer

Threat Logs

Question 11

An administrator runs the command and sees the above output. What is the most likely cause of the large number of handshake failures?

Accepted Answer

The server is using an unsupported cipher suite.. The output shows a large number of handshake failures, which typically occur during the SSL/TLS handshake when the client and server cannot agree on a common cipher suite. If the server only supports weak or outdated ciphers that the firewall's decryption policy does not allow, or if the firewall's SSL forward proxy engine does not support the server's chosen cipher, the handshake will fail. This is the most likely cause because cipher suite mismatch is a common source of handshake failures in decryption environments.

Answer

The firewall's CRL server is unreachable.

Answer

The decryption policy is not matching the traffic.

Answer

The firewall's certificate is not trusted by clients.

Question 12

A user at IP 10.0.0.10 is accessing a server at 192.168.1.5. According to the decryption policy, what will happen to the traffic?

Accepted Answer

The traffic will not be decrypted because of the no-decrypt rule.. The decryption policy contains a no-decrypt rule that matches traffic from source IP 10.0.0.10 to destination IP 192.168.1.5. Since the no-decrypt rule explicitly excludes this traffic from decryption, the firewall will forward the traffic without applying any decryption profile. This is the correct behavior because no-decrypt rules take precedence over decrypt rules for matching traffic.

Answer

The traffic will be decrypted using the default profile.

Answer

The traffic will be decrypted using the inbound profile.

Answer

The traffic will be blocked because no security rule allows it.

Question 13

An administrator sees the above traffic log entries. What can be concluded about the traffic to 192.168.1.1?

Accepted Answer

The traffic was decrypted because it matched a decryption policy.. The traffic log entries indicate that the session to 192.168.1.1 was decrypted, as shown by the decryption flag or action field (e.g., 'decrypt'). This occurs when the traffic matches a decryption policy configured on the firewall, typically for SSL/TLS inspection. The destination being internal (192.168.1.1) and the application being SSL are not sufficient conditions for decryption; a matching decryption rule is required.

Answer

The traffic was decrypted because the application is SSL.

Answer

The traffic was not decrypted because it matched a no-decrypt policy.

Answer

The traffic was not decrypted because the destination is external.

Question 14

An admin notices that decryption is failing for some sites with error 'SSL Handshake Failed' in the traffic log. The decryption policy uses a custom SSL/TLS service profile with 'Allow Self-Signed Certificates' enabled. The firewall's certificate was issued by an internal CA. What should the admin check first?

Accepted Answer

The server certificate chain is invalid. The error 'SSL Handshake Failed' typically indicates a problem with the server certificate chain, such as an intermediate CA certificate missing or an untrusted root. Even with 'Allow Self-Signed Certificates' enabled, the firewall must validate the entire certificate chain for forward decryption; if the chain is invalid or incomplete, the handshake fails. The admin should first verify that the server's certificate chain is complete and trusted by the firewall's certificate store.

Answer

The firewall's certificate is expired

Answer

The decryption policy's action is set to 'decrypt'

Answer

The client is using an outdated browser

Question 15

An organization uses inbound inspection decryption for their public-facing web servers. They have imported the server's certificate and private key into the firewall. However, some clients report 'untrusted certificate' warnings. What is the most likely cause?

Accepted Answer

The firewall is not configured with the root CA certificate. When a firewall performs inbound inspection decryption, it re-encrypts traffic using the server's certificate. If the firewall does not have the root CA certificate that issued the server's certificate, the firewall cannot present a complete certificate chain to clients. Clients then see the certificate as untrusted because the issuing CA is not recognized, even though the server's certificate and private key are correctly imported.

Answer

The server's certificate is using an unsupported cipher

Answer

The decryption profile's 'Unsupported Modes' is set to 'Block'

Answer

The decryption policy is not matching the traffic

Question 16

An administrator wants to view logs related to decryption failures. Which log type should they use?

Accepted Answer

Traffic logs. Traffic logs capture all session-level events, including decryption failures, because they record the action taken by the firewall (e.g., 'decrypt', 'no-decrypt', or 'decrypt-error'). When decryption fails due to issues like certificate validation errors, unsupported cipher suites, or handshake failures, the firewall logs the session as a traffic log entry with a specific reason code. This makes Traffic logs the correct source for troubleshooting decryption failures.

Answer

Threat logs

Answer

URL Filtering logs

Answer

System logs

Question 17

A company uses SSL Forward Proxy decryption. After implementing, they notice that some internal applications that use client certificate authentication are failing. What is the most likely cause?

Accepted Answer

The firewall is not configured to forward client certificates. SSL Forward Proxy decryption intercepts and re-encrypts traffic, which strips the original client certificate from the TLS handshake. For internal applications that require client certificate authentication, the firewall must be explicitly configured to forward the client certificate to the destination server. Without this forwarding, the server never receives the certificate, causing authentication failures.

Answer

The SSL/TLS service profile does not allow self-signed certificates

Answer

The decryption profile's 'Block Unsupported Modes' is enabled

Answer

The decryption policy is set to 'decrypt' but not 'proxy'

Question 18

Which TWO actions should be taken when configuring SSL Forward Proxy decryption? (Select exactly two.)

Accepted Answer

Generate or import a CA certificate for the firewall. SSL Forward Proxy decryption requires the firewall to act as a trusted intermediary. To do this, the firewall must generate or import a CA certificate that client browsers will trust, allowing it to dynamically generate and sign server certificates for decrypted sessions. Without this CA certificate, clients will receive untrusted certificate warnings, and decryption will fail.

Answer

Import the server's private key

Answer

Import the server certificate

Answer

Enable SSH decryption

Question 19

After enabling SSL decryption, users report that some websites fail to load. The firewall logs show 'decryption error' for these sites. Which decryption profile setting should the administrator check first?

Accepted Answer

Block sessions with untrusted issuers. When SSL decryption is enabled, the firewall acts as a man-in-the-middle and must re-sign the server's certificate with its own CA. If the server's certificate is issued by an untrusted CA (i.e., not in the firewall's trusted CA list), the firewall cannot verify the chain of trust and will block the session if the 'Block sessions with untrusted issuers' option is enabled. This is the most common cause of 'decryption error' logs for sites that previously worked without decryption.

Answer

Block sessions with expired certificates

Answer

Block sessions with certificate status unknown

Answer

Block sessions with unsupported cipher suites

Question 20

A financial services firm deploys inbound SSL decryption to inspect all HTTPS traffic to their customer-facing web application. After enabling decryption, customers report that they are unable to connect to the web app and receive 'This site can’t provide a secure connection' errors. The firewall logs show no decryption errors, and traffic logs show the sessions are matched to the decryption rule but no decryption action is taken. The web app uses a wildcard certificate (*.example.com). The firewall's decryption certificate is imported from the server's private key. What is the most likely cause?

Accepted Answer

The decryption rule is configured with the forward proxy method.. Inbound SSL decryption requires the 'SSL Inbound Inspection' method, not the forward proxy method. Forward proxy is used for outbound decryption where the firewall generates a certificate on the fly. For inbound decryption, the firewall must use the server's private key to decrypt traffic, which is configured via an SSL Inbound Inspection rule. Since the rule is set to forward proxy, the firewall attempts to re-encrypt with its own certificate, causing a certificate mismatch and the 'secure connection' error.

Answer

The firewall does not support wildcard certificates for inbound decryption.

Answer

The web server is not properly configured to handle decrypted traffic.

Answer

The decryption profile is set to 'Block sessions with untrusted certificates'.