PCNSA Decryption and Monitoring Practice Question
A company has a Palo Alto firewall with both inbound and outbound decryption. The security team notices that some traffic to a specific internal server is being double-decrypted: first by inbound decryption when the client is internal, and second by outbound decryption when the server initiates connections to external resources. This causes performance issues and certificate warnings. The firewall policy has separate rules for inbound and outbound decryption, and all internal traffic passes through the firewall. How should the administrator resolve this?
⚠ Common exam trap
The trap here is that candidates may focus on excluding specific traffic (options A, C, D) rather than correcting the zone-based scope of the inbound decryption rule, which is the fundamental cause of the double-decryption problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the inbound decryption rule only applies to traffic from external sources, not internal.
The core issue is that inbound decryption is incorrectly applied to traffic from internal clients to the internal server, causing double decryption when the server subsequently initiates outbound connections. By ensuring the inbound decryption rule only applies to traffic from external sources (i.e., source zone is untrust), internal-to-internal traffic bypasses inbound decryption, eliminating the double-decryption loop. This aligns with best practices where inbound decryption is scoped to traffic originating outside the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a decryption exclusion rule for traffic between internal clients and the internal server.
Why it's wrong here
Excluding this traffic from all decryption would remove security visibility.
- ✓
Ensure that the inbound decryption rule only applies to traffic from external sources, not internal.
Why this is correct
By restricting the source zone to Untrust, internal clients will not be subject to inbound decryption, eliminating double decryption.
- ✗
Disable outbound decryption for the subnet of the internal server.
Why it's wrong here
This would stop outbound decryption for the server, but the server's outbound traffic may need inspection.
- ✗
Use a no-decrypt rule for traffic from the internal server's IP to the internet.
Why it's wrong here
This only addresses outbound decryption, not the inbound decryption applied to internal clients.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.