PCNSE Practice Test 32 — 15 Questions

Question 1

A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?

Accepted Answer

The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.. In a forward proxy decryption scenario, the firewall generates a self-signed root CA certificate and uses it to sign per-session certificates for intercepted HTTPS traffic. If that root CA certificate is not installed in the client's trusted root certificate store, the browser will treat the per-session certificates as untrusted, resulting in certificate errors. Option C directly identifies this missing trust chain as the root cause.

Answer

The firewall is using a forward trust certificate that is expired.

Answer

The decryption policy is not applied to the correct security rule.

Answer

The decryption policy is set to 'no-decrypt' for the traffic.

Question 2

A Palo Alto Networks firewall is configured for SSL Forward Proxy decryption. The security team wants to ensure that decrypted traffic is also inspected by an external DLP appliance. How should this be achieved?

Accepted Answer

Configure a Decryption Policy to decrypt traffic and then use a Decryption Forwarding service to forward decrypted traffic to the DLP appliance.. Option B is correct because the Palo Alto Networks firewall can be configured with a Decryption Forwarding service, which allows decrypted traffic to be forwarded to an external DLP appliance for additional inspection. This is achieved by defining a Decryption Forwarding profile that specifies the DLP appliance as the destination, ensuring that traffic decrypted by the SSL Forward Proxy is sent in clear text to the DLP appliance for content inspection.

Answer

Configure the DLP appliance to decrypt traffic itself.

Answer

Configure the firewall to re-encrypt traffic before sending to DLP.

Answer

Add a decryption policy on the firewall to exclude traffic to the DLP appliance.

Question 3

In a Panorama-managed deployment, the device group has a rule called 'Allow-Web' that allows 'web-browsing'. The local firewall also has a rule with the same name and content. After Panorama pushes the device group configuration, what happens to the local rule?

Accepted Answer

Both rules are present; the device group rule takes precedence and the local rule is not installed.. In a Panorama-managed deployment, when a device group rule and a local firewall rule share the same name, Panorama does not overwrite or delete the local rule. Instead, the device group rule is installed and takes precedence, while the local rule remains on the firewall but is not active in the rulebase. This is because Panorama manages the device group configuration as a separate administrative domain, and local rules are preserved to allow for local override scenarios.

Answer

The local rule is overwritten by the device group rule.

Answer

The local rule is deleted.

Answer

The rules are merged into a single rule.

Question 4

Based on the exhibit, what is the most likely action for the firewall to take on this session?

Accepted Answer

Bypass decryption and allow the session to proceed.. The firewall is configured for SSL Forward Proxy decryption, but the server certificate is self-signed or otherwise untrusted (e.g., expired, mismatched CN). In such cases, the firewall cannot re-sign the certificate to establish a trusted decrypted session. The configured action for untrusted server certificates is 'bypass decryption,' which allows the session to proceed without decryption, logging the bypass. Option D is correct because the firewall will not block or drop the session by default when bypass is configured.

Answer

Re-issue a new certificate to the client.

Answer

Block the session because the server certificate is invalid.

Answer

Drop the session and log a security alert.

Question 5

A company uses SSL Forward Proxy decryption for user traffic. Recently, some users cannot access a specific HTTPS website that uses a self-signed certificate. The firewall's decryption policy is set to 'decrypt' and the action is 'forward proxy'. The firewall does not have the self-signed CA certificate installed. What is the most likely cause of the issue?

Accepted Answer

The firewall cannot decrypt the session because it does not trust the self-signed certificate of the website.. In SSL Forward Proxy decryption, the firewall must generate a new server certificate on-the-fly to present to the client. To do this, it needs to trust the original server's certificate so it can validate the server's identity and then re-sign the session. Since the website uses a self-signed certificate and the firewall does not have that CA certificate installed, the firewall cannot validate the server's certificate, causing the decryption to fail and the session to be blocked.

Answer

The website is not included in the decryption policy's URL category.

Answer

The firewall's decryption certificate is not trusted by the client browsers.

Answer

The firewall's forward proxy decryption requires a server certificate that matches the original website.

Question 6

Which TWO of the following are minimum required configurations to enable User-ID on a Palo Alto Networks firewall? (Choose exactly two.)

Accepted Answer

Configure a server profile for LDAP or other authentication protocol.. A is correct because User-ID requires a server profile (e.g., LDAP, Kerberos, or a WMI-based agent) to query the directory service for user-to-IP mappings. Without this profile, the firewall cannot resolve usernames from authentication events or directory lookups, which is the foundational step for User-ID functionality.

Answer

Deploy a User-ID agent on every domain controller.

Answer

Install a captive portal to authenticate users.

Answer

Configure a security policy rule that uses a user group as a source.

Question 7

A user reports that after SSL decryption was enabled, certain web applications fail to load completely. What is the most likely reason?

Accepted Answer

The application uses certificate pinning which rejects the firewall's decryption certificate.. Certificate pinning is a security mechanism where an application embeds the exact certificate or public key of the server it expects to communicate with. When SSL decryption is enabled, the firewall replaces the original server certificate with its own decryption certificate. The application detects this mismatch and rejects the connection, causing it to fail to load completely. This is a common issue with applications that implement strict certificate pinning, such as banking apps or certain mobile applications.

Answer

The URL is not allowed in the decryption policy.

Answer

The user's browser proxy settings are incorrect.

Answer

The firewall's decryption is causing excessive latency.

Question 8

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

Accepted Answer

Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.. Option C is correct because creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Answer

Configure decryption settings per interface to distribute load.

Answer

Disable SSL decryption entirely to avoid performance issues.

Answer

Enable decryption on all traffic to ensure complete visibility.

Question 9

Which THREE steps should be taken to troubleshoot an SSL decryption issue where users are unable to access specific HTTPS websites? (Choose three.)

Accepted Answer

Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.. Option A is correct because the decryption log provides direct visibility into SSL/TLS handshake failures. Errors like 'ssl_decrypt_unsupported_cipher' indicate the firewall cannot negotiate a cipher it supports, while 'ssl_decrypt_cert_verify_failed' points to certificate validation issues, such as an untrusted or expired server certificate. These logs are the primary diagnostic tool for pinpointing why decryption fails for specific HTTPS sites.

Answer

Update the URL filtering database to ensure the site is categorized correctly.

Answer

Disable decryption globally to see if the sites become accessible.

Question 10

After enabling SSL Forward Proxy decryption, users report that they cannot access HTTPS websites and receive certificate errors. The firewall's decryption certificate is properly installed on client machines. What is the most likely cause?

Accepted Answer

The firewall's decryption certificate is not trusted by the clients' certificate store.. The most likely cause is that the firewall's decryption certificate is not trusted by the clients' certificate store. Even if the certificate is properly installed on client machines, if it is not explicitly added to the trusted root certification authorities store, browsers will reject the connection with certificate errors. SSL Forward Proxy decryption requires the firewall to generate a new certificate for each HTTPS session, signed by its own CA certificate; clients must trust that CA certificate to avoid warnings.

Answer

The decryption certificate has expired.

Answer

The decryption certificate is not renewed automatically.

Answer

The decryption certificate is self-signed.

Question 11

An organization is deploying SSL inbound proxy decryption (SSLi) to protect servers in a DMZ. Which consideration is critical for the firewall to properly decrypt inbound traffic destined to these servers?

Accepted Answer

The firewall must possess the server's private key to re-encrypt traffic.. In SSL inbound proxy decryption (SSLi), the firewall acts as a man-in-the-middle. To decrypt the client's encrypted request, it must terminate the TLS connection from the client. To then re-encrypt and forward the request to the destination server, the firewall needs the server's private key to generate a new TLS session with the server. Without the private key, the firewall cannot complete the re-encryption handshake with the server, making option C correct.

Answer

The firewall must present the server's public certificate to clients.

Answer

The firewall must have a trusted CA certificate installed.

Answer

The firewall must be configured to only accept TLS 1.2 or higher.

Question 12

What is the primary purpose of SSL decryption in a Palo Alto Networks firewall?

Accepted Answer

Inspect encrypted traffic for malware, exploits, and data leakage.. SSL decryption in a Palo Alto Networks firewall is primarily used to inspect encrypted traffic (HTTPS, SMTPS, etc.) for threats such as malware, exploits, and data leakage. Without decryption, the firewall cannot apply threat prevention, URL filtering, or data filtering policies to the encrypted payload, leaving a blind spot in security enforcement.

Answer

Mask the original source IP address for privacy.

Answer

Allow only inbound SSL traffic to be inspected.

Answer

Improve network performance by reducing encryption overhead.

Question 13

Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?

Accepted Answer

The User-ID agent is not configured with the firewall's IP as a client. Option C is correct because the User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.

Answer

The user is using a VPN connection from a remote location

Answer

The firewall's User-ID agent is in collector mode

Answer

The user's traffic is being decrypted by SSL decryption

Question 14

During SSL decryption, the firewall logs show 'ssl_decrypt_unsupported_cipher' errors for several connections. What is the likely cause and solution?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the client or server.. The 'ssl_decrypt_unsupported_cipher' error indicates that the firewall's SSL/TLS proxy cannot negotiate a common cipher suite with the client or server during the decryption handshake. This occurs when the cipher suites configured in the firewall's SSL/TLS service profile do not include the ciphers offered by the client or required by the server. The solution is to update the service profile to include the necessary cipher suites, such as those based on AES-GCM or CHACHA20-POLY1305, ensuring compatibility.

Answer

The firewall does not support decryption of that traffic.

Answer

The decryption certificate is not trusted by the client.

Answer

The decryption rule is not matching the traffic.

Question 15

Which best practice should be followed for certificate management when deploying SSL Forward Proxy decryption in a large enterprise?

Accepted Answer

Use an internal certificate authority (CA) and distribute the CA certificate to all clients via Group Policy.. Using an internal CA and distributing its certificate via Group Policy ensures that all clients trust the decryption certificate used by the firewall to re-encrypt traffic. This avoids certificate warnings and allows seamless SSL Forward Proxy decryption. It also enables centralized management and revocation, which is critical for large enterprise deployments.

Answer

Use a self-signed certificate and manually install it on each client.

Answer

Use a wildcard certificate from a public CA to simplify deployment.

Answer

Use a certificate from a public CA that is already trusted by clients.