PCNSE Decryption and SSL Inspection Practice Test 3 — 15 Questions

Question 1

During SSL decryption, the firewall logs show 'ssl_decrypt_unsupported_cipher' errors for several connections. What is the likely cause and solution?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the client or server.. The 'ssl_decrypt_unsupported_cipher' error indicates that the firewall's SSL/TLS proxy cannot negotiate a common cipher suite with the client or server during the decryption handshake. This occurs when the cipher suites configured in the firewall's SSL/TLS service profile do not include the ciphers offered by the client or required by the server. The solution is to update the service profile to include the necessary cipher suites, such as those based on AES-GCM or CHACHA20-POLY1305, ensuring compatibility.

Answer

The firewall does not support decryption of that traffic.

Answer

The decryption certificate is not trusted by the client.

Answer

The decryption rule is not matching the traffic.

Question 2

A user reports that after SSL decryption was enabled, certain web applications fail to load completely. What is the most likely reason?

Accepted Answer

The application uses certificate pinning which rejects the firewall's decryption certificate.. Certificate pinning is a security mechanism where an application embeds the exact certificate or public key of the server it expects to communicate with. When SSL decryption is enabled, the firewall replaces the original server certificate with its own decryption certificate. The application detects this mismatch and rejects the connection, causing it to fail to load completely. This is a common issue with applications that implement strict certificate pinning, such as banking apps or certain mobile applications.

Answer

The URL is not allowed in the decryption policy.

Answer

The user's browser proxy settings are incorrect.

Answer

The firewall's decryption is causing excessive latency.

Question 3

Which THREE steps should be taken to troubleshoot an SSL decryption issue where users are unable to access specific HTTPS websites? (Choose three.)

Accepted Answer

Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.. Option A is correct because the decryption log is the primary place to identify the exact failure reason, and messages like 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed' directly point to cipher mismatch or certificate validation problems breaking the HTTPS session. Option C is correct because SSL decryption requires the firewall to present its own certificate to the client; if that forward-trust or decryption certificate is not trusted by the client, the TLS handshake fails and the site becomes inaccessible. Option E is correct because a packet capture of the SSL handshake across client, firewall, and server reveals where the handshake breaks, such as a failed ClientHello, certificate alert, or SNI mismatch, which is essential for isolating the fault. Option B does not belong because URL filtering database categorization affects policy enforcement, not the cryptographic SSL decryption process. Option D does not belong because disabling decryption globally is a disruptive workaround, not a troubleshooting step, and it would not identify the root cause of the decryption failure.

Answer

Update the URL filtering database to ensure the site is categorized correctly.

Answer

Disable decryption globally to see if the sites become accessible.

Question 4

Based on the exhibit, what is the most likely cause for the majority of bypassed sessions?

Accepted Answer

The firewall's SSL/TLS service profile does not include the cipher suites used by the clients or servers.. The majority of bypassed sessions are most likely caused by a cipher mismatch between the firewall's SSL/TLS service profile and the clients or servers. When the firewall decrypts traffic, it must negotiate a cipher suite that both the client and server support; if the service profile does not include the cipher suites used by the endpoints, the firewall cannot complete the SSL/TLS handshake and bypasses the session. This is a common misconfiguration in Palo Alto Networks firewalls where the SSL/TLS service profile's cipher list is too restrictive.

Answer

The firewall is overloaded and cannot handle more decryption sessions.

Answer

The decryption certificate is not trusted by clients.

Answer

There is a network connectivity issue between firewall and servers.

Question 5

Which TWO of the following are supported decryption scenarios on a Palo Alto Networks firewall?

Accepted Answer

SSL Forward Proxy. B is correct because SSL Forward Proxy allows the firewall to decrypt outbound traffic from internal clients to external servers by acting as an intermediary, generating a new certificate on the fly to inspect the session. E is correct because SSL Inbound Inspection enables the firewall to decrypt inbound traffic destined for protected servers, typically by importing the server's private key, allowing inspection of encrypted payloads.

Answer

Decryption Broker

Answer

SSL Termination

Answer

SSH Proxy

Question 6

A multinational corporation uses Palo Alto Networks firewalls at its headquarters and five branch offices. SSL Forward Proxy decryption is enabled for all outbound HTTPS traffic. Recently, users in the finance department have reported that several banking and financial websites fail to load, displaying a certificate error in the browser. The errors occur only for these specific sites, while other HTTPS sites work fine. The firewall administrator has already added decryption exclusion rules for the affected domains, but the problem persists. The decryption policy is configured with a single rule that decrypts all ssl service traffic, and the exclusion rules are placed below this global decrypt rule. Which of the following is the best course of action to resolve the issue?

Accepted Answer

Reorder the decryption policy rules so that the exclusion rules are above the global decrypt rule. Palo Alto Networks decryption policy rules are evaluated in top-down order, and the first matching rule is applied. Since the exclusion rules are placed below the global decrypt rule that decrypts all SSL traffic, the global rule matches first and decrypts the traffic, causing certificate errors on sites that require specific handling. Reordering the exclusion rules above the global rule ensures they are evaluated first, allowing the affected domains to bypass decryption and load correctly.

Answer

Create a decryption profile that excludes the failing domains

Answer

Disable SSL decryption for all traffic

Answer

Replace the firewall's internal CA certificate with a publicly trusted certificate

Question 7

A network security engineer is configuring SSL Forward Proxy decryption on a Palo Alto Networks firewall. The firewall must present a certificate to internal users for any external site they visit, signed by the company's internal certificate authority. The company's CA certificate is already imported into the firewall. Which additional configuration is required on the firewall to ensure that the Forward Trust certificate is used for signing website certificates?

Accepted Answer

Create a certificate signing request (CSR) for the Forward Trust certificate, have it signed by the internal CA, and import the signed certificate.. For SSL Forward Proxy decryption, the firewall must have a Forward Trust certificate that is trusted by internal clients. This certificate is typically a subordinate certificate signed by the organization's internal CA. The firewall generates a CSR, the CA signs it, and the resulting certificate is imported and configured as the Forward Trust certificate. This allows the firewall to dynamically generate certificates for external sites that clients will trust.

Answer

Generate a new self-signed certificate on the firewall and assign it as the Forward Trust certificate.

Answer

Assign the internal CA certificate directly as the Forward Trust certificate without generating a CSR.

Answer

Import the internal CA's private key and certificate into the firewall and designate it as the Forward Trust certificate.

Question 8

A security engineer deployed SSL Forward Proxy decryption to inspect outbound HTTPS traffic. Several users report that when they access a partner's HTTPS portal, the browser shows a certificate warning and the site fails to load. The firewall's forward trust certificate is signed by the company's internal certificate authority. Which action should the engineer take to resolve the issue while maintaining decryption?

Accepted Answer

Import the internal certificate authority's root certificate into the users' browsers' trusted root store.. The browser warning occurs because the firewall re-signs the partner site's certificate with its forward trust certificate, which is issued by the company's internal CA. If the client does not trust that CA, validation fails. Importing the internal CA root into the users' browsers' trusted root store establishes trust, allowing decryption to continue without warnings. The other options either bypass decryption or misuse certificate types, failing to resolve the trust issue.

Answer

Add the partner site to the SSL Decryption Exclusion list.

Answer

Install the forward untrust certificate on the firewall and present it to the partner site.

Answer

Configure the firewall to use the forward trust certificate as the forward untrust certificate.

Question 9

A security administrator has configured SSL decryption on a Palo Alto Networks firewall. After decryption, some users report that they cannot access a specific banking website, and the firewall logs show the session as 'decryption excluded' for that site. The administrator wants to ensure that the firewall does not decrypt traffic to this banking site while still decrypting all other HTTPS traffic. What should the administrator configure to achieve this?

Accepted Answer

Create a decryption policy rule with the action 'no-decrypt' and match the banking site's URL category or FQDN.. To exclude specific traffic from SSL decryption, a decryption policy rule with the action 'no-decrypt' must be created and placed above the decryption rule. This rule can match on various criteria such as URL category, FQDN, or source/destination. This ensures that the banking site's traffic bypasses decryption while other HTTPS traffic continues to be decrypted.

Answer

Add the banking site's certificate to the firewall's trusted certificate list and set the decryption policy to 'decrypt'.

Answer

Configure a decryption profile with 'Block Untrusted Issuers' enabled and apply it to the decryption policy rule.

Answer

Modify the existing decryption policy rule to exclude the banking site by adding its IP address to the source field.

Question 10

A network security administrator is configuring SSL decryption on a Palo Alto Networks firewall. The administrator wants to ensure that traffic to a specific banking website is never decrypted due to privacy concerns. Which configuration object should be used to achieve this?

Accepted Answer

SSL Decryption Exclusion list with the specific domain of the banking website.. The SSL Decryption Exclusion list is designed to bypass decryption for specific domains based on the server certificate's CN or SAN. Adding the banking website's domain ensures that traffic to that site is not decrypted, addressing privacy concerns without affecting other traffic. Other options either apply too broadly, block traffic incorrectly, or do not provide selective exclusion.

Answer

SSL Forward Proxy setting with 'Strip TLS 1.3' enabled.

Answer

Decryption profile with 'Block sessions with untrusted issuers' enabled.

Answer

Decryption policy rule with action 'no-decrypt' and a URL category of 'financial-services'.

Question 11

A network engineer is deploying SSL Forward Proxy decryption on a Palo Alto Networks firewall. The engineer wants to ensure that the firewall can decrypt traffic to external sites while also being able to detect if a server presents an expired certificate. Which decryption profile setting should be enabled to block sessions when the server certificate is expired?

Accepted Answer

Block sessions with expired certificates under SSL Forward Proxy settings.. Within a decryption profile, the SSL Forward Proxy settings include an option to block sessions when the server certificate is expired. Enabling this ensures that the firewall checks the validity period of the server's certificate and drops the connection if it has expired. This is the correct setting to meet the requirement.

Answer

Block sessions with unknown certificate status under SSL Forward Proxy settings.

Answer

Block sessions with untrusted issuers under SSL Forward Proxy settings.

Answer

Block sessions with client authentication failures under SSL Forward Proxy settings.

Question 12

A security engineer is configuring SSL decryption on a Palo Alto Networks firewall. The engineer wants to ensure that the firewall can decrypt outbound HTTPS traffic and present a valid certificate to internal users. Which certificate must be installed on the firewall to sign the certificates presented to internal users during SSL Forward Proxy decryption?

Accepted Answer

Forward trust certificate. The forward trust certificate is specifically designed for SSL Forward Proxy decryption. It is a CA certificate that the firewall uses to sign the certificates presented to internal users. Clients must trust this certificate to avoid errors. The forward untrust certificate is used for untrusted server certificates, and the SSL inbound certificate is for inbound inspection.

Answer

SSL inbound certificate

Answer

Forward untrust certificate

Answer

Root CA certificate

Question 13

A security administrator notices that after enabling SSL decryption, some users cannot access a website that uses a self-signed certificate. The firewall is configured with SSL Forward Proxy decryption. What is the most likely cause of the access issue?

Accepted Answer

The firewall's forward trust certificate is not trusted by the client, causing a certificate warning that prevents access.. The most likely cause is that the client does not trust the firewall's forward trust certificate. When SSL Forward Proxy decryption is enabled, the firewall re-signs the website's certificate with its forward trust certificate. If the client does not trust the CA that issued the forward trust certificate, it will display a warning and may block access. This is a common oversight when deploying decryption.

Answer

The website's certificate is not trusted by the firewall, so the firewall blocks the connection.

Answer

The website requires TLS 1.3, which the firewall cannot decrypt.

Answer

The decryption policy rule is misconfigured to not decrypt the website.

Question 14

A network engineer is troubleshooting an SSL decryption issue on a PA-5220 firewall. Users are unable to access a specific HTTPS website after SSL decryption was enabled. The engineer checks the Decryption policy and confirms that the rule for outbound HTTPS decryption is correctly configured and matched. The firewall's decryption profile is set to block sessions with untrusted issuers. The website uses a certificate signed by a public CA that is trusted by the firewall. What is the most likely cause of the access issue?

Accepted Answer

The website uses certificate pinning, causing the client to reject the firewall's forged certificate.. Certificate pinning causes clients to expect a specific certificate or public key for a website. When SSL Forward Proxy decryption is enabled, the firewall presents a forged certificate, which the client rejects due to pinning. This results in access failures. Exempting such sites from decryption is a typical solution. Other causes like expired certificates or licensing are not applicable here.

Answer

The firewall's decryption profile is blocking the session because the website's certificate is expired.

Answer

The firewall's SSL decryption license has expired, causing it to block decrypted sessions.

Answer

The website requires TLS 1.3, which is not supported by the firewall's decryption profile.

Question 15

A network security engineer is troubleshooting an SSL decryption issue. Users report that after decryption was enabled, they cannot access certain HTTPS websites that use certificate pinning. The firewall is configured with SSL Forward Proxy decryption. Which action should the engineer take to allow access to these websites while still decrypting other traffic?

Accepted Answer

Add the websites to the SSL Decryption Exclusion list.. Certificate pinning causes applications to reject certificates not signed by the expected CA. When the firewall decrypts and re-signs, the pinned certificate is replaced, causing failures. Adding the affected websites to the SSL Decryption Exclusion list bypasses decryption for them, allowing the original certificate to be presented and satisfying pinning. This maintains decryption for other traffic.

Answer

Configure the firewall to use the forward untrust certificate for these websites.

Answer

Disable SSL decryption globally.

Answer

Enable 'Block sessions with untrusted issuers' in the decryption profile.