PCNSA Decryption and Monitoring Practice Question
A firewall administrator is configuring SSL decryption for internal users. Which THREE components are required for forward proxy decryption to function properly? (Choose three.)
⚠ Common exam trap
It's easy for candidates to confuse forward proxy decryption (which requires the firewall's own CA certificate and its deployment to clients) with inbound/SSL termination decryption (which requires the server's private key), leading candidates to incorrectly select Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's root CA certificate deployed to client browsers
In forward proxy decryption, the firewall acts as a trusted intermediary by generating a certificate for each HTTPS site the user visits, signed by the firewall's own root CA. For this to work without browser security warnings, the firewall's root CA certificate must be deployed to every client browser's trusted root store. This allows the browser to trust the firewall's dynamically generated server certificates, enabling seamless decryption and inspection of outbound SSL/TLS traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server's private key
Why it's wrong here
In forward proxy decryption, the firewall generates a substitute certificate on the fly to intercept and re-encrypt traffic, so it never requires the original server’s private key. The server’s private key is only needed in inbound proxy decryption, where the firewall impersonates the server to inspect incoming traffic. This option is tempting because administrators often associate SSL decryption with possessing the server’s key, but forward proxy decryption relies on a locally trusted CA certificate, not the destination server’s key material.
- ✓
The firewall's root CA certificate deployed to client browsers
Why this is correct
Clients must trust the firewall's CA to avoid certificate warnings.
- ✗
A security policy rule allowing decrypted traffic
Why it's wrong here
A security policy is needed for traffic flow but is not a component of decryption itself.
- ✓
A decryption policy rule with action 'decrypt'
Why this is correct
A decryption rule must be set to 'decrypt' to trigger decryption.
- ✓
A CA certificate installed on the firewall
Why this is correct
The firewall uses its CA certificate to generate certificates for decrypted sessions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.