PCNSE Decryption and SSL Inspection Practice Test 2 — 15 Questions

Question 1

A company has deployed SSL Inbound Inspection to inspect HTTPS traffic to their internal web server hosting a custom application that requires mutual TLS authentication. The firewall is configured with a decryption policy that includes the server's certificate and the action 'decrypt'. The web server is configured to request client certificates. After implementation, users report that the application fails to authenticate them. The firewall logs show that SSL handshake with the client completes successfully, but the server never receives the client certificate during the handshake. The administrator has verified that the decryption policy is active and the server certificate is correctly imported. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall is not configured to forward client certificates to the server.. In SSL Inbound Inspection, the firewall acts as a man-in-the-middle, terminating the client's SSL connection and then initiating a new SSL connection to the server. By default, the firewall does not forward the client certificate from the original client handshake to the server. To enable mutual TLS authentication, the administrator must explicitly configure the firewall to forward client certificates, typically via a Decryption Profile setting. Since the logs show a successful handshake with the client but the server never receives the client certificate, the missing forwarding configuration is the most likely cause.

Answer

The decryption policy is set to 'no-decrypt' for the application's traffic.

Answer

The client certificates are not trusted by the firewall.

Answer

The firewall's SSL Inbound Inspection profile is set to 'passive' mode.

Question 2

A network administrator observes that some SSL connections are failing to be decrypted. Based on the exhibit, what is the most likely reason for the majority of the failures?

Accepted Answer

No decryption policy rule matches the traffic. The exhibit shows a decryption policy with no matching rules for the failing SSL connections. When no decryption policy rule matches, the firewall forwards the traffic without decrypting it, which can cause failures if the firewall is configured to block non-decrypted traffic or if the application requires inspection. This is the most common cause of decryption failures in Palo Alto Networks firewalls, as decryption is policy-driven and traffic must match a rule to be decrypted.

Answer

The firewall's certificate is not trusted by clients

Answer

The client and server negotiate an unsupported cipher

Answer

The decryption profile is misconfigured

Question 3

A security engineer at a financial services company is implementing SSL Forward Proxy decryption on a Palo Alto Networks firewall to inspect outbound HTTPS traffic. The company has strict compliance requirements and wants to avoid decrypting traffic to banking and healthcare websites. The engineer needs to configure the firewall to bypass decryption for these sites while still decrypting all other HTTPS traffic. Which TWO actions should the engineer take to achieve this goal? (Choose two.)

Accepted Answer

Create a custom URL category containing the banking and healthcare domains and apply it as a no-decrypt rule in the decryption policy.. To bypass decryption for specific sites, the engineer must create a custom URL category containing those domains and then reference it in a decryption policy rule with the action 'no-decrypt'. This rule must be placed before any decrypt rules to ensure it takes precedence. This approach satisfies compliance requirements while allowing decryption of other HTTPS traffic.

Answer

Create a security policy rule that allows traffic to the banking and healthcare sites without any decryption profile.

Answer

Set up a decryption profile with 'Block sessions with expired certificates' and apply it to the no-decrypt rule.

Answer

Enable SSL Forward Proxy decryption on the firewall and use the default decryption policy to exclude financial and healthcare sites.

Question 4

An engineer is configuring SSL Forward Proxy decryption on a PA-5220 firewall running PAN-OS 11.1. The firewall must decrypt outbound HTTPS traffic for all users except those in the Finance department, who must be exempt from decryption. The engineer creates a Decryption policy rule with a source user group 'Finance' and action 'no-decrypt'. However, after committing, Finance users report that their HTTPS traffic is still being decrypted. What is the most likely reason?

Accepted Answer

The Decryption policy rule with 'no-decrypt' action must be placed above the decryption rule in the policy order.. Decryption policy rules are processed in order, and the first matching rule dictates the action. A rule that decrypts traffic for all users will match Finance users before a subsequent no-decrypt rule, causing their traffic to be decrypted. Moving the no-decrypt rule above the decryption rule ensures Finance traffic is exempted. This ordering principle is critical for granular decryption exemptions.

Answer

The Finance user group must be mapped to an LDAP server before it can be used in a Decryption policy rule.

Answer

SSL Forward Proxy decryption must be enabled globally before any no-decrypt rules can take effect.

Answer

The 'no-decrypt' action is not supported for user group-based rules; only IP addresses can be exempted.

Question 5

A network security administrator is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. Users report that after enabling decryption, they receive certificate errors when accessing HTTPS websites. The administrator has already installed the forward trust certificate on the firewall and deployed the forward trust CA certificate to all user workstations via Group Policy. What is the most likely cause of the certificate errors?

Accepted Answer

The forward trust CA certificate is not installed in the Trusted Root Certification Authorities store on the workstations.. The most likely cause is that the forward trust CA certificate is not installed in the Trusted Root Certification Authorities store on the workstations. Even if deployed via Group Policy, it might be placed in a different store or not trusted. Clients must trust the CA that signs the certificates generated by the firewall to avoid errors.

Answer

The forward trust certificate is not marked as a CA certificate.

Answer

The decryption policy is not applied to the correct zones.

Answer

The firewall's forward untrust certificate is expired.

Question 6

An engineer is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. The engineer wants to ensure that the firewall can decrypt outbound HTTPS traffic and that users do not receive certificate warnings. Which two actions are required? (Choose two.)

Accepted Answer

Install a forward trust certificate on the firewall.. To perform SSL Forward Proxy decryption without certificate warnings, the firewall must have a forward trust certificate installed, and the clients must trust the CA that issued it. The forward trust certificate allows the firewall to re-sign server certificates, and importing the CA into client trust stores ensures those re-signed certificates are trusted. Other options are either part of the configuration but not directly related to avoiding warnings, or are incorrect.

Answer

Enable SSL Forward Proxy in the decryption profile.

Answer

Configure a decryption policy rule with action 'decrypt' for outbound traffic.

Answer

Set the forward untrust certificate as the forward trust certificate.

Question 7

A network security engineer is troubleshooting an SSL decryption issue on a PA-3220 firewall. Users report that HTTPS websites with certificates signed by an internal enterprise CA are not being decrypted, while other HTTPS sites are decrypted successfully. The engineer verifies that the Decryption policy rule is correctly configured to decrypt all outbound HTTPS traffic. What is the most likely cause?

Accepted Answer

The internal enterprise CA certificate is not imported into the firewall's trusted root CA store, causing the firewall to bypass decryption for those sites.. SSL Forward Proxy decryption requires the firewall to trust the certificate issuer to generate a forged certificate for the server. If the internal enterprise CA is not imported into the firewall's trusted root CA store, the firewall cannot validate the original certificate and will bypass decryption for those sites. Adding the CA certificate to the trusted root store enables decryption for internal CA-signed sites.

Answer

The firewall's decryption profile is configured to block sessions with untrusted issuers, causing a bypass for internal CA-signed sites.

Answer

The websites using the internal CA are excluded by a predefined URL category that is set to 'no-decrypt' by default.

Answer

The firewall's SSL decryption license has expired, disabling decryption for all sites except those with publicly trusted certificates.

Question 8

A network security administrator is troubleshooting SSL Forward Proxy decryption on a Palo Alto Networks firewall. Users report that they can access most HTTPS websites, but when they try to access a specific banking website, the connection fails with a certificate error. The administrator checks the decryption policy and sees that there is a no-decrypt rule for the banking category, placed above the decrypt rule. The decryption profile attached to the decrypt rule has 'Block sessions with untrusted issuers' enabled. What is the most likely reason for the connection failure?

Accepted Answer

The decryption profile is blocking the session because the banking site's certificate is untrusted, and the no-decrypt rule is not being applied.. The most likely reason is that the no-decrypt rule is not being applied to the banking site, so the session is decrypted. The decryption profile then blocks the session because the banking site's certificate is untrusted. This could happen if the banking site's URL is not correctly categorized or if the no-decrypt rule is placed after the decrypt rule.

Answer

The forward trust certificate is not installed on the firewall.

Answer

The firewall's SSL decryption license has expired.

Answer

The no-decrypt rule is not matching because the URL category is not correctly configured.

Question 9

A security administrator is configuring SSL Forward Proxy decryption on a PA-3220 firewall. The administrator needs to ensure that the firewall can decrypt outbound HTTPS traffic and that users do not receive certificate warnings. Which two actions must be performed? (Choose two.)

Accepted Answer

Import a forward trust certificate and key into the firewall.. To enable SSL Forward Proxy decryption, the firewall must have a forward trust certificate to sign forged certificates, and a Decryption policy rule with action 'decrypt' to trigger decryption. Additionally, the forward trust certificate must be installed on clients as a trusted root CA to avoid certificate warnings, but that is a client-side action. The two required actions on the firewall are importing the forward trust certificate and configuring the decryption policy rule.

Answer

Enable SSL decryption in the firewall's management interface settings.

Answer

Create a decryption profile that blocks sessions with untrusted issuers.

Answer

Install the forward trust certificate on all client systems as a trusted root CA.

Question 10

An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?

Accepted Answer

Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.. It follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.

Answer

Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.

Answer

Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.

Answer

Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.

Question 11

A company is deploying SSL Forward Proxy decryption for outbound HTTPS traffic. They want to ensure that traffic to financial sites (e.g., *.bank.com) is not decrypted due to compliance requirements. Which method should be used to exclude this traffic from decryption?

Accepted Answer

Create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'.. In Palo Alto Networks firewalls, SSL Forward Proxy decryption is controlled by Decryption Policy rules. To exclude specific traffic from decryption, you create a Decryption Policy rule that matches the traffic (e.g., destination domain *.bank.com) and set the action to 'No Decrypt'. This ensures the firewall forwards the traffic without intercepting or decrypting it, meeting compliance requirements.

Answer

Configure the SSL/TLS Service Profile to bypass decryption for the domain.

Answer

Configure a Decryption Profile to exclude the domain.

Answer

Enable certificate revocation checking for the decryption zone.

Question 12

Which TWO of the following are valid considerations when designing an SSL Forward Proxy decryption deployment in a Palo Alto Networks firewall?

Accepted Answer

When deploying SSL Forward Proxy, the firewall must generate a certificate for each decrypted session to re-encrypt traffic to the client.. Option C is correct because SSL Forward Proxy works by having the firewall act as a man-in-the-middle: it intercepts the client's TLS session, presents a certificate it generates (signed by a Forward Trust certificate) for the requested server, and then establishes a separate TLS session to the actual server, so a certificate must be generated for each decrypted session to re-encrypt traffic to the client. Option E is correct because decryption in Palo Alto Networks firewalls is governed by a Decryption policy, which lets administrators selectively define which traffic (by source, destination, user, URL category, service, etc.) is decrypted, forwarded, or excluded from decryption. Option A is incorrect because decryption is not global; the Decryption policy enables granular, selective decryption and exclusions. Option B is incorrect because SSL Forward Proxy cannot decrypt sessions that use client certificate authentication (mutual TLS), since the firewall cannot present the client's private key. Option D is incorrect because SNI is not a requirement that forces decryption; traffic with SNI can pass through undecrypted, and the firewall does not drop it merely for using SNI.

Answer

Decryption is applied globally to all traffic; selective decryption is not possible.

Answer

The firewall can decrypt all TLS sessions regardless of client certificate authentication.

Answer

Traffic using Server Name Indication (SNI) in TLS must be decrypted at the firewall or it will be dropped.

Question 13

Order the steps to configure a static route on a Palo Alto Networks firewall.

Accepted Answer

Navigate to the virtual router, add a static route, configure destination and next-hop, then commit.. The correct order to configure a static route on a Palo Alto Networks firewall is: navigate to the appropriate virtual router, add a new static route entry, configure the destination address and next-hop, and then commit the configuration. This ensures the route is properly defined and applied.

Answer

Navigate to the virtual router, configure destination and next-hop, add the static route, then commit.

Answer

Navigate to the virtual router, add a static route, commit, then configure destination and next-hop.

Answer

Add a static route, navigate to the virtual router, configure destination and next-hop, then commit.

Question 14

A security administrator wants to minimize the performance impact of SSL decryption on the firewall. Which best practice should be applied?

Accepted Answer

Create decryption exclusion rules for traffic that is known to be low-risk and high-volume.. Creating decryption exclusion rules for low-risk, high-volume traffic (e.g., software updates, video streaming, or trusted CDN traffic) reduces the firewall's decryption workload, minimizing performance impact while still allowing decryption of sensitive or risky traffic. This aligns with Palo Alto Networks best practices to balance security and performance by excluding traffic that does not require inspection.

Answer

Configure decryption settings per interface to distribute load.

Answer

Disable SSL decryption entirely to avoid performance issues.

Answer

Enable decryption on all traffic to ensure complete visibility.

Question 15

What is the primary purpose of SSL decryption in a Palo Alto Networks firewall?

Accepted Answer

Inspect encrypted traffic for malware, exploits, and data leakage.. SSL decryption in a Palo Alto Networks firewall is primarily used to inspect encrypted traffic (HTTPS, SMTPS, etc.) for threats such as malware, exploits, and data leakage. Without decryption, the firewall cannot apply threat prevention, URL filtering, or data filtering policies to the encrypted payload, leaving a blind spot in security enforcement.

Answer

Mask the original source IP address for privacy.

Answer

Allow only inbound SSL traffic to be inspected.

Answer

Improve network performance by reducing encryption overhead.