Cybersecurity-Apprentice Network Security Practice Question
An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.
SSL Forward Proxy decryption requires importing a valid Forward Trust Certificate (signed by an enterprise CA trusted by the endpoints) onto the firewall and pushing the CA to the client certificate stores.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.
Why it's wrong here
While a self-signed cert on the firewall works, enterprise deployments require a certificate signed by the enterprise internal CA.
- ✗
Deploy SSH Proxy decryption rules to intercept TLS handshakes.
Why it's wrong here
SSH Proxy is for managing SSH sessions, not HTTPS web traffic.
- ✓
Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.
Why this is correct
SSL Forward Proxy decrypts outbound traffic and requires the trust certificate to be installed on clients to prevent warnings.
- ✗
Enable SSL Inbound Inspection using the public certificate of the destination web server.
Why it's wrong here
SSL Inbound Inspection is for protecting servers hosted behind the firewall, not outbound client traffic.
About these practice questions
One of 177 original Cybersecurity-Apprentice practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Apprentice practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Apprentice exam.