PCNSE Decryption and SSL Inspection — 15 Questions

Question 1

Which THREE statements are true regarding SSL Forward Proxy decryption on Palo Alto Networks firewalls?

Accepted Answer

Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.. Palo Alto Networks decryption policy rules can match on a wide range of criteria including source zone, source user, destination IP, URL category, and service. This granularity allows administrators to selectively decrypt traffic based on business needs and security policies, not just basic IP/port matching.

Answer

SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.

Answer

An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.

Question 2

You are a network security engineer at a multinational corporation. The company has a main data center and three branch offices connected via MPLS. The firewall at the data center is a PA-5250 running PAN-OS 10.2. The firewall is configured for SSL Forward Proxy decryption of all outbound HTTPS traffic from internal users to the internet. Recently, users in Branch Office A report that they cannot access several external HTTPS websites, while users at other branches and the data center have no issues. The decryption policy for Branch Office A is identical to the others. You check the decryption statistics and see that for Branch Office A, the number of 'SSL handshake failures' is high. You also notice that the firewall's system log shows errors like 'peer certificate chain validation failure' for sessions from Branch Office A. The firewall has a forward trust certificate issued by an internal CA, and the internal CA certificate is installed on all clients. What is the most likely cause of this issue?

Accepted Answer

Traffic from Branch Office A is asymmetrically routed, causing the TLS handshake to be incomplete.. C is correct because asymmetric routing causes the firewall to see only one side of the TCP handshake, preventing it from completing the TLS handshake. When traffic from Branch Office A takes a different return path (e.g., via another MPLS link or direct internet breakout), the firewall cannot associate the server's SYN-ACK with the original client SYN, leading to SSL handshake failures and 'peer certificate chain validation failure' errors in the logs. The decryption policy and certificates are identical across branches, so the issue is specific to the network path.

Answer

The forward trust certificate has expired or is not trusted by the clients in Branch Office A.

Answer

The decryption profile for Branch Office A is configured with an incorrect cipher suite that is not supported by the external websites.

Answer

The decryption policy rule for Branch Office A is missing the 'ssl-decrypt' action.

Question 3

Match each high availability (HA) term to its definition.

Accepted Answer

Active/Passive: One firewall actively processes traffic; the other remains on standby.. The correct matches are: Active/Passive (A), Heartbeat (C), and Preemption (E). The distractors swap definitions: B confuses Active/Active with Failover, and D confuses Failover with Active/Active.

Answer

Active/Active: The process by which the passive firewall takes over.

Answer

Failover: Both firewalls process traffic simultaneously.

Question 4

After enabling SSL Forward Proxy decryption, users report that they cannot access HTTPS websites and receive certificate errors. The firewall's decryption certificate is properly installed on client machines. What is the most likely cause?

Accepted Answer

The firewall's decryption certificate is not trusted by the clients' certificate store.. The most likely cause is that the firewall's decryption certificate is not trusted by the clients' certificate store. Even if the certificate is properly installed on client machines, if it is not explicitly added to the trusted root certification authorities store, browsers will reject the connection with certificate errors. SSL Forward Proxy decryption requires the firewall to generate a new certificate for each HTTPS session, signed by its own CA certificate; clients must trust that CA certificate to avoid warnings.

Answer

The decryption certificate has expired.

Answer

The decryption certificate is not renewed automatically.

Answer

The decryption certificate is self-signed.

Question 5

An organization is deploying SSL inbound proxy decryption (SSLi) to protect servers in a DMZ. Which consideration is critical for the firewall to properly decrypt inbound traffic destined to these servers?

Accepted Answer

The firewall must possess the server's private key to re-encrypt traffic.. In SSL inbound proxy decryption (SSLi), the firewall acts as a man-in-the-middle. To decrypt the client's encrypted request, it must terminate the TLS connection from the client. To then re-encrypt and forward the request to the destination server, the firewall needs the server's private key to generate a new TLS session with the server. Without the private key, the firewall cannot complete the re-encryption handshake with the server, making option C correct.

Answer

The firewall must present the server's public certificate to clients.

Answer

The firewall must have a trusted CA certificate installed.

Answer

The firewall must be configured to only accept TLS 1.2 or higher.

Question 6

A company wants to decrypt traffic to productivity and collaboration sites but avoid decrypting traffic to financial and healthcare sites due to compliance. How should the SSL decryption policy be configured?

Accepted Answer

Create a rule to decrypt based on URL categories except financial and healthcare.. Palo Alto Networks' SSL decryption policy can use URL categories to specify which traffic to decrypt. Creating a rule that decrypts traffic based on URL categories except for financial and healthcare ensures compliance by never decrypting those sensitive categories. Option A is wrong because maintaining a custom URL list is inefficient and prone to errors compared to using built-in categories. Option B is wrong because a decrypt-all rule with exceptions would initially decrypt all traffic, including financial and healthcare, before the exception is applied, which could violate compliance. Option D is wrong because decryption policy does not support time-based rules.

Answer

Add all financial and healthcare sites to a custom URL list and exclude them.

Answer

Create a decrypt-all rule and then add exceptions for financial and healthcare categories.

Answer

Use time-based rules to apply decryption only during business hours.

Question 7

Which best practice should be followed for certificate management when deploying SSL Forward Proxy decryption in a large enterprise?

Accepted Answer

Use an internal certificate authority (CA) and distribute the CA certificate to all clients via Group Policy.. Using an internal CA and distributing its certificate via Group Policy ensures that all clients trust the decryption certificate used by the firewall to re-encrypt traffic. This avoids certificate warnings and allows seamless SSL Forward Proxy decryption. It also enables centralized management and revocation, which is critical for large enterprise deployments.

Answer

Use a self-signed certificate and manually install it on each client.

Answer

Use a wildcard certificate from a public CA to simplify deployment.

Answer

Use a certificate from a public CA that is already trusted by clients.

Question 8

A Palo Alto Networks firewall is configured for SSL Forward Proxy decryption. The security team wants to ensure that decrypted traffic is also inspected by an external DLP appliance. How should this be achieved?

Accepted Answer

Configure a Decryption Policy to decrypt traffic and then use a Decryption Forwarding service to forward decrypted traffic to the DLP appliance.. The Palo Alto Networks firewall can be configured with a Decryption Forwarding service, which allows decrypted traffic to be forwarded to an external DLP appliance for additional inspection. This is achieved by defining a Decryption Forwarding profile that specifies the DLP appliance as the destination, ensuring that traffic decrypted by the SSL Forward Proxy is sent in clear text to the DLP appliance for content inspection.

Answer

Configure the DLP appliance to decrypt traffic itself.

Answer

Configure the firewall to re-encrypt traffic before sending to DLP.

Answer

Add a decryption policy on the firewall to exclude traffic to the DLP appliance.

Question 9

Which TWO conditions typically cause the firewall to bypass SSL decryption for a session? (Choose two.)

Accepted Answer

The client and server negotiate a cipher suite not supported by the firewall.. Option B is correct because SSL decryption requires the firewall to support the negotiated cipher suite; if the client and server agree on a cipher suite the firewall cannot process (e.g., an unsupported key exchange or encryption algorithm), the firewall cannot decrypt and therefore bypasses the session. Option C is correct because when the server presents an invalid certificate (expired, untrusted, or otherwise failing validation), the firewall cannot safely perform decryption and typically bypasses it rather than breaking the connection. Option A is not a typical bypass condition because the firewall generally cannot reliably detect that another device already decrypted the session, and such detection is not a standard decryption-bypass trigger. Option D is not a bypass condition but an explicit administrative policy action; a no-decrypt rule intentionally excludes traffic from decryption rather than being a condition that causes an automatic bypass. Option E is not a bypass condition because decrypted data size thresholds are not a standard reason for the firewall to stop decrypting a session.

Answer

The firewall detects that the session is already decrypted (e.g., by another device).

Answer

The traffic matches a 'no-decrypt' rule in the decryption policy.

Answer

The decrypted data exceeds a certain size threshold.

Question 10

Which TWO types of traffic should typically be excluded from SSL decryption for compliance or operational reasons? (Choose two.)

Accepted Answer

Traffic to healthcare portals and electronic medical records.. Options C and D are correct because SSL decryption of healthcare portals and electronic medical records (EMR) traffic risks exposing protected health information (PHI) regulated under HIPAA, while decrypting financial services sites (banking, investment) can violate GLBA, PCI DSS, and privacy laws, and may also break certificate pinning used by banks. Both categories are typically excluded via SSL decryption bypass/exception policies in a next-generation firewall to maintain regulatory compliance and avoid legal liability. Option A is not typically excluded for compliance reasons; social media traffic is often decrypted and controlled by policy. Option B, internal data center server-to-server traffic, is usually not decrypted because it is trusted east-west traffic, but the question asks for compliance/operational reasons tied to regulated external categories, and B is not marked correct. Option E, external email services like Gmail, is generally decrypted and inspected for data loss prevention, not excluded for compliance.

Answer

Traffic to social media websites.

Answer

Traffic between internal data center servers.

Answer

Traffic to external email services (e.g., Gmail).

Question 11

A user from subnet 10.0.1.0/24 accesses a website categorized as 'Finance'. Based on the exhibit, what will be the result?

Accepted Answer

The traffic will be decrypted by Rule 2.. Rule 2 matches traffic from subnet 10.0.1.0/24 to the 'Finance' category and has an action of 'decrypt'. The exhibit shows Rule 2 with source 10.0.1.0/24, destination category 'Finance', and action 'decrypt'. Since the user's traffic matches all criteria in Rule 2, it will be decrypted. Rule 3 is not evaluated because Rule 2 matches first and has a higher priority (lower rule number).

Answer

The traffic will not be decrypted because Rule 3 matches.

Answer

The traffic will be blocked because no matching rule exists.

Answer

The traffic will be decrypted by Rule 1.

Question 12

Based on the exhibit, what is the most likely action for the firewall to take on this session?

Accepted Answer

Bypass decryption and allow the session to proceed.. The firewall is configured for SSL Forward Proxy decryption, but the server certificate is self-signed or otherwise untrusted (e.g., expired, mismatched CN). In such cases, the firewall cannot re-sign the certificate to establish a trusted decrypted session. The configured action for untrusted server certificates is 'bypass decryption,' which allows the session to proceed without decryption, logging the bypass. Option D is correct because the firewall will not block or drop the session by default when bypass is configured.

Answer

Re-issue a new certificate to the client.

Answer

Block the session because the server certificate is invalid.

Answer

Drop the session and log a security alert.

Question 13

A company uses SSL Forward Proxy decryption for user traffic. Recently, some users cannot access a specific HTTPS website that uses a self-signed certificate. The firewall's decryption policy is set to 'decrypt' and the action is 'forward proxy'. The firewall does not have the self-signed CA certificate installed. What is the most likely cause of the issue?

Accepted Answer

The firewall cannot decrypt the session because it does not trust the self-signed certificate of the website.. In SSL Forward Proxy decryption, the firewall must generate a new server certificate on-the-fly to present to the client. To do this, it needs to trust the original server's certificate so it can validate the server's identity and then re-sign the session. Since the website uses a self-signed certificate and the firewall does not have that CA certificate installed, the firewall cannot validate the server's certificate, causing the decryption to fail and the session to be blocked.

Answer

The website is not included in the decryption policy's URL category.

Answer

The firewall's decryption certificate is not trusted by the client browsers.

Answer

The firewall's forward proxy decryption requires a server certificate that matches the original website.

Question 14

Which TWO statements are true about TLS version 1.3 support in Palo Alto Networks decryption?

Accepted Answer

TLS 1.3 decryption is supported in PAN-OS 9.0 and later.. Option B is correct because Palo Alto Networks introduced TLS 1.3 decryption support starting with PAN-OS 9.0, so firewalls running 9.0 or later can decrypt TLS 1.3 traffic. Option E is correct because TLS 1.3 decryption is supported in both forward proxy (SSL Forward Proxy) and inbound inspection (SSL Inbound Inspection) deployments, not limited to a single mode. Option A is incorrect because TLS 1.3 uses a different cipher suite structure than TLS 1.2 (TLS 1.3 removed legacy ciphers and uses AEAD-only suites like AES-GCM and ChaCha20-Poly1305), so the proxy ciphers are not the same. Option C is incorrect because TLS 1.3 decryption does not require an HSM; HSM is used for private key storage/offload, not as a prerequisite for TLS 1.3 decryption. Option D is incorrect because TLS 1.3 decryption is not restricted to inbound inspection only; it also works with forward proxy as stated in option E.

Answer

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Answer

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Answer

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Question 15

A network administrator is troubleshooting decryption failures for HTTPS traffic to a financial website. The firewall is configured with SSL Forward Proxy decryption policy that applies to the 'financial-services' URL category. The firewall uses an internal CA certificate to sign generated certificates. Users report a certificate error in their browsers when accessing 'https://www.bankofalice.com'. The error says the certificate is not trusted, even though the internal CA certificate is installed on all client devices. The administrator checks the firewall logs and sees no decryption errors; the session is being decrypted successfully. The administrator also confirms that the decryption policy is active and the firewall is not bypassing decryption. What is the most likely cause of the certificate error?

Accepted Answer

The website uses Certificate Pinning which causes the browser to reject the firewall's certificate.. Certificate pinning (HTTP Public Key Pinning or HPKP) causes the browser to reject any certificate that does not match the pinned public key, even if the firewall's certificate is signed by a trusted internal CA. Since the firewall generates a new certificate on-the-fly with its own key pair, the browser detects the mismatch and displays a certificate error, despite successful decryption at the firewall.

Answer

The firewall's decryption certificate does not have the correct subject name for the website.

Answer

The firewall's decryption certificate is expired.

Answer

The decryption policy is configured to 'no-decrypt' for that traffic.