PCNSE Decryption and SSL Inspection — 15 Questions

Question 1

An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?

Accepted Answer

Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.. Option B is correct because it follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.

Answer

Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.

Answer

Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.

Answer

Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.

Question 2

Which THREE statements are true regarding SSL Forward Proxy decryption on Palo Alto Networks firewalls?

Accepted Answer

Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.. Option B is correct because Palo Alto Networks decryption policy rules can match on a wide range of criteria including source zone, source user, destination IP, URL category, and service. This granularity allows administrators to selectively decrypt traffic based on business needs and security policies, not just basic IP/port matching.

Answer

SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.

Answer

An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.

Question 3

You are a network security engineer at a multinational corporation. The company has a main data center and three branch offices connected via MPLS. The firewall at the data center is a PA-5250 running PAN-OS 10.2. The firewall is configured for SSL Forward Proxy decryption of all outbound HTTPS traffic from internal users to the internet. Recently, users in Branch Office A report that they cannot access several external HTTPS websites, while users at other branches and the data center have no issues. The decryption policy for Branch Office A is identical to the others. You check the decryption statistics and see that for Branch Office A, the number of 'SSL handshake failures' is high. You also notice that the firewall's system log shows errors like 'peer certificate chain validation failure' for sessions from Branch Office A. The firewall has a forward trust certificate issued by an internal CA, and the internal CA certificate is installed on all clients. What is the most likely cause of this issue?

Accepted Answer

Traffic from Branch Office A is asymmetrically routed, causing the TLS handshake to be incomplete.. C is correct because asymmetric routing causes the firewall to see only one side of the TCP handshake, preventing it from completing the TLS handshake. When traffic from Branch Office A takes a different return path (e.g., via another MPLS link or direct internet breakout), the firewall cannot associate the server's SYN-ACK with the original client SYN, leading to SSL handshake failures and 'peer certificate chain validation failure' errors in the logs. The decryption policy and certificates are identical across branches, so the issue is specific to the network path.

Answer

The forward trust certificate has expired or is not trusted by the clients in Branch Office A.

Answer

The decryption profile for Branch Office A is configured with an incorrect cipher suite that is not supported by the external websites.

Answer

The decryption policy rule for Branch Office A is missing the 'ssl-decrypt' action.

Question 4

A company is deploying SSL Forward Proxy decryption for outbound HTTPS traffic. They want to ensure that traffic to financial sites (e.g., *.bank.com) is not decrypted due to compliance requirements. Which method should be used to exclude this traffic from decryption?

Accepted Answer

Create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'.. Option C is correct because in Palo Alto Networks firewalls, SSL Forward Proxy decryption is controlled by Decryption Policy rules. To exclude specific traffic from decryption, you create a Decryption Policy rule that matches the traffic (e.g., destination domain *.bank.com) and set the action to 'No Decrypt'. This ensures the firewall forwards the traffic without intercepting or decrypting it, meeting compliance requirements.

Answer

Configure the SSL/TLS Service Profile to bypass decryption for the domain.

Answer

Configure a Decryption Profile to exclude the domain.

Answer

Enable certificate revocation checking for the decryption zone.

Question 5

Which TWO of the following are valid considerations when designing an SSL Forward Proxy decryption deployment in a Palo Alto Networks firewall?

Accepted Answer

When deploying SSL Forward Proxy, the firewall must generate a certificate for each decrypted session to re-encrypt traffic to the client.. In an SSL Forward Proxy deployment, the firewall acts as a man-in-the-middle: it terminates the client's TLS connection, inspects the decrypted traffic, and then initiates a new TLS connection to the server. To re-encrypt the traffic back to the client, the firewall must dynamically generate a certificate for each session, signed by a trusted CA certificate installed on the client devices. This ensures the client sees a valid certificate chain and does not generate a certificate warning.

Answer

Decryption is applied globally to all traffic; selective decryption is not possible.

Answer

The firewall can decrypt all TLS sessions regardless of client certificate authentication.

Answer

Traffic using Server Name Indication (SNI) in TLS must be decrypted at the firewall or it will be dropped.

Question 6

Order the steps to configure a static route on a Palo Alto Networks firewall.

Question 7

Match each high availability (HA) term to its definition.

Question 8

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

Accepted Answer

Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.. Option C is correct because creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Answer

Configure decryption settings per interface to distribute load.

Answer

Disable SSL decryption entirely to avoid performance issues.

Answer

Enable decryption on all traffic to ensure complete visibility.

Question 9

After enabling SSL Forward Proxy decryption, users report that they cannot access HTTPS websites and receive certificate errors. The firewall's decryption certificate is properly installed on client machines. What is the most likely cause?

Accepted Answer

The firewall's decryption certificate is not trusted by the clients' certificate store.. The most likely cause is that the firewall's decryption certificate is not trusted by the clients' certificate store. Even if the certificate is properly installed on client machines, if it is not explicitly added to the trusted root certification authorities store, browsers will reject the connection with certificate errors. SSL Forward Proxy decryption requires the firewall to generate a new certificate for each HTTPS session, signed by its own CA certificate; clients must trust that CA certificate to avoid warnings.

Answer

The decryption certificate has expired.

Answer

The decryption certificate is not renewed automatically.

Answer

The decryption certificate is self-signed.

Question 10

An organization is deploying SSL inbound proxy decryption (SSLi) to protect servers in a DMZ. Which consideration is critical for the firewall to properly decrypt inbound traffic destined to these servers?

Accepted Answer

The firewall must possess the server's private key to re-encrypt traffic.. In SSL inbound proxy decryption (SSLi), the firewall acts as a man-in-the-middle. To decrypt the client's encrypted request, it must terminate the TLS connection from the client. To then re-encrypt and forward the request to the destination server, the firewall needs the server's private key to generate a new TLS session with the server. Without the private key, the firewall cannot complete the re-encryption handshake with the server, making option C correct.

Answer

The firewall must present the server's public certificate to clients.

Answer

The firewall must have a trusted CA certificate installed.

Answer

The firewall must be configured to only accept TLS 1.2 or higher.

Question 11

What is the primary purpose of SSL decryption in a Palo Alto Networks firewall?

Accepted Answer

Inspect encrypted traffic for malware, exploits, and data leakage.. SSL decryption in a Palo Alto Networks firewall is primarily used to inspect encrypted traffic (HTTPS, SMTPS, etc.) for threats such as malware, exploits, and data leakage. Without decryption, the firewall cannot apply threat prevention, URL filtering, or data filtering policies to the encrypted payload, leaving a blind spot in security enforcement.

Answer

Mask the original source IP address for privacy.

Answer

Allow only inbound SSL traffic to be inspected.

Answer

Improve network performance by reducing encryption overhead.

Question 12

A company wants to decrypt traffic to productivity and collaboration sites but avoid decrypting traffic to financial and healthcare sites due to compliance. How should the SSL decryption policy be configured?

Accepted Answer

Create a rule to decrypt based on URL categories except financial and healthcare.. Option B is correct because URL Category-based rules allow granular exclusion by category. Option A is wrong because decrypting all then blocking exceptions is inefficient. Option C is wrong because site lists are static and not category-based. Option D is wrong because decryption policy does not support schedule-based rules.

Answer

Add all financial and healthcare sites to a custom URL list and exclude them.

Answer

Create a decrypt-all rule and then add exceptions for financial and healthcare categories.

Answer

Use time-based rules to apply decryption only during business hours.

Question 13

During SSL decryption, the firewall logs show 'ssl_decrypt_unsupported_cipher' errors for several connections. What is the likely cause and solution?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the client or server.. The 'ssl_decrypt_unsupported_cipher' error indicates that the firewall's SSL/TLS proxy cannot negotiate a common cipher suite with the client or server during the decryption handshake. This occurs when the cipher suites configured in the firewall's SSL/TLS service profile do not include the ciphers offered by the client or required by the server. The solution is to update the service profile to include the necessary cipher suites, such as those based on AES-GCM or CHACHA20-POLY1305, ensuring compatibility.

Answer

The firewall does not support decryption of that traffic.

Answer

The decryption certificate is not trusted by the client.

Answer

The decryption rule is not matching the traffic.

Question 14

A user reports that after SSL decryption was enabled, certain web applications fail to load completely. What is the most likely reason?

Accepted Answer

The application uses certificate pinning which rejects the firewall's decryption certificate.. Certificate pinning is a security mechanism where an application embeds the exact certificate or public key of the server it expects to communicate with. When SSL decryption is enabled, the firewall replaces the original server certificate with its own decryption certificate. The application detects this mismatch and rejects the connection, causing it to fail to load completely. This is a common issue with applications that implement strict certificate pinning, such as banking apps or certain mobile applications.

Answer

The URL is not allowed in the decryption policy.

Answer

The user's browser proxy settings are incorrect.

Answer

The firewall's decryption is causing excessive latency.

Question 15

Which best practice should be followed for certificate management when deploying SSL Forward Proxy decryption in a large enterprise?

Accepted Answer

Use an internal certificate authority (CA) and distribute the CA certificate to all clients via Group Policy.. Using an internal CA and distributing its certificate via Group Policy ensures that all clients trust the decryption certificate used by the firewall to re-encrypt traffic. This avoids certificate warnings and allows seamless SSL Forward Proxy decryption. It also enables centralized management and revocation, which is critical for large enterprise deployments.

Answer

Use a self-signed certificate and manually install it on each client.

Answer

Use a wildcard certificate from a public CA to simplify deployment.

Answer

Use a certificate from a public CA that is already trusted by clients.