PCNSE Decryption and SSL Inspection — 10 Questions

Question 1

An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.. It follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.

Answer

Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.

Answer

Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.

Answer

Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.

Question 2

Which THREE statements are true regarding SSL Forward Proxy decryption on Palo Alto Networks firewalls?

Accepted Answer

Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.. Palo Alto Networks decryption policy rules can match on a wide range of criteria including source zone, source user, destination IP, URL category, and service. This granularity allows administrators to selectively decrypt traffic based on business needs and security policies, not just basic IP/port matching.

Answer

SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.

Answer

An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.

Question 3

You are a network security engineer at a multinational corporation. The company has a main data center and three branch offices connected via MPLS. The firewall at the data center is a PA-5250 running PAN-OS 10.2. The firewall is configured for SSL Forward Proxy decryption of all outbound HTTPS traffic from internal users to the internet. Recently, users in Branch Office A report that they cannot access several external HTTPS websites, while users at other branches and the data center have no issues. The decryption policy for Branch Office A is identical to the others. You check the decryption statistics and see that for Branch Office A, the number of 'SSL handshake failures' is high. You also notice that the firewall's system log shows errors like 'peer certificate chain validation failure' for sessions from Branch Office A. The firewall has a forward trust certificate issued by an internal CA, and the internal CA certificate is installed on all clients. What is the most likely cause of this issue?

Accepted Answer

Traffic from Branch Office A is asymmetrically routed, causing the TLS handshake to be incomplete.. C is correct because asymmetric routing causes the firewall to see only one side of the TCP handshake, preventing it from completing the TLS handshake. When traffic from Branch Office A takes a different return path (e.g., via another MPLS link or direct internet breakout), the firewall cannot associate the server's SYN-ACK with the original client SYN, leading to SSL handshake failures and 'peer certificate chain validation failure' errors in the logs. The decryption policy and certificates are identical across branches, so the issue is specific to the network path.

Answer

The forward trust certificate has expired or is not trusted by the clients in Branch Office A.

Answer

The decryption profile for Branch Office A is configured with an incorrect cipher suite that is not supported by the external websites.

Answer

The decryption policy rule for Branch Office A is missing the 'ssl-decrypt' action.

Question 4

A company is deploying SSL Forward Proxy decryption for outbound HTTPS traffic. They want to ensure that traffic to financial sites (e.g., *.bank.com) is not decrypted due to compliance requirements. Which method should be used to exclude this traffic from decryption?

Accepted Answer

Create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'.. In Palo Alto Networks firewalls, SSL Forward Proxy decryption is controlled by Decryption Policy rules. To exclude specific traffic from decryption, you create a Decryption Policy rule that matches the traffic (e.g., destination domain *.bank.com) and set the action to 'No Decrypt'. This ensures the firewall forwards the traffic without intercepting or decrypting it, meeting compliance requirements.

Answer

Configure the SSL/TLS Service Profile to bypass decryption for the domain.

Answer

Configure a Decryption Profile to exclude the domain.

Answer

Enable certificate revocation checking for the decryption zone.

Question 5

Which TWO of the following are valid considerations when designing an SSL Forward Proxy decryption deployment in a Palo Alto Networks firewall?

Accepted Answer

When deploying SSL Forward Proxy, the firewall must generate a certificate for each decrypted session to re-encrypt traffic to the client.. In an SSL Forward Proxy deployment, the firewall acts as a man-in-the-middle: it terminates the client's TLS connection, inspects the decrypted traffic, and then initiates a new TLS connection to the server. To re-encrypt the traffic back to the client, the firewall must dynamically generate a certificate for each session, signed by a trusted CA certificate installed on the client devices. This ensures the client sees a valid certificate chain and does not generate a certificate warning.

Answer

Decryption is applied globally to all traffic; selective decryption is not possible.

Answer

The firewall can decrypt all TLS sessions regardless of client certificate authentication.

Answer

Traffic using Server Name Indication (SNI) in TLS must be decrypted at the firewall or it will be dropped.

Question 6

Order the steps to configure a static route on a Palo Alto Networks firewall.

Accepted Answer

Navigate to the virtual router, add a static route, configure destination and next-hop, then commit.. The correct order to configure a static route on a Palo Alto Networks firewall is: navigate to the appropriate virtual router, add a new static route entry, configure the destination address and next-hop, and then commit the configuration. This ensures the route is properly defined and applied.

Answer

Navigate to the virtual router, configure destination and next-hop, add the static route, then commit.

Answer

Navigate to the virtual router, add a static route, commit, then configure destination and next-hop.

Answer

Add a static route, navigate to the virtual router, configure destination and next-hop, then commit.

Question 7

Match each high availability (HA) term to its definition.

Accepted Answer

Active/Passive: One firewall actively processes traffic; the other remains on standby.. The correct matches are: Active/Passive (A), Heartbeat (C), and Preemption (E). The distractors swap definitions: B confuses Active/Active with Failover, and D confuses Failover with Active/Active.

Answer

Active/Active: The process by which the passive firewall takes over.

Answer

Failover: Both firewalls process traffic simultaneously.

Question 8

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

Accepted Answer

Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.. Creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Answer

Configure decryption settings per interface to distribute load.

Answer

Disable SSL decryption entirely to avoid performance issues.

Answer

Enable decryption on all traffic to ensure complete visibility.

Question 9

After enabling SSL Forward Proxy decryption, users report that they cannot access HTTPS websites and receive certificate errors. The firewall's decryption certificate is properly installed on client machines. What is the most likely cause?

Accepted Answer

The firewall's decryption certificate is not trusted by the clients' certificate store.. The most likely cause is that the firewall's decryption certificate is not trusted by the clients' certificate store. Even if the certificate is properly installed on client machines, if it is not explicitly added to the trusted root certification authorities store, browsers will reject the connection with certificate errors. SSL Forward Proxy decryption requires the firewall to generate a new certificate for each HTTPS session, signed by its own CA certificate; clients must trust that CA certificate to avoid warnings.

Answer

The decryption certificate has expired.

Answer

The decryption certificate is not renewed automatically.

Answer

The decryption certificate is self-signed.

Question 10

An organization is deploying SSL inbound proxy decryption (SSLi) to protect servers in a DMZ. Which consideration is critical for the firewall to properly decrypt inbound traffic destined to these servers?

Accepted Answer

The firewall must possess the server's private key to re-encrypt traffic.. In SSL inbound proxy decryption (SSLi), the firewall acts as a man-in-the-middle. To decrypt the client's encrypted request, it must terminate the TLS connection from the client. To then re-encrypt and forward the request to the destination server, the firewall needs the server's private key to generate a new TLS session with the server. Without the private key, the firewall cannot complete the re-encryption handshake with the server, making option C correct.

Answer

The firewall must present the server's public certificate to clients.

Answer

The firewall must have a trusted CA certificate installed.

Answer

The firewall must be configured to only accept TLS 1.2 or higher.