PCNSA Decryption and Monitoring Practice Question
A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?
⚠ Common exam trap
Watch out — candidates often confuse the need for a decryption profile (Option D) with the fundamental requirement of a trusted root CA certificate, or they mistakenly think blocking untrusted certificates (Option A) is the cause of errors rather than a consequence of missing trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's decryption certificate is not signed by the installed root CA.
In forward proxy decryption, the firewall generates a decryption certificate that must be signed by the trusted root CA installed on the endpoints. If the decryption certificate is self-signed or signed by a different CA, the browser will not trust it, causing certificate errors. The root CA certificate must be installed on all endpoints to establish a chain of trust for the firewall-generated certificates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The decryption profile is set to block sessions with untrusted certificates.
Why it's wrong here
Blocking untrusted certificates would result in blocked sessions, not just certificate errors.
- ✗
The firewall is performing inbound inspection instead of forward proxy.
Why it's wrong here
Inbound inspection is for traffic destined to servers, not outbound client traffic.
- ✓
The firewall's decryption certificate is not signed by the installed root CA.
Why this is correct
The firewall's decryption certificate must be signed by the root CA installed on endpoints; otherwise, errors occur.
- ✗
No decryption profile is attached to the decryption rule.
Why it's wrong here
Without a profile, the firewall uses default settings which still decrypt traffic.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.