PCNSA Decryption and Monitoring Practice Question
A network security administrator is configuring a Palo Alto Networks firewall to decrypt outbound HTTPS traffic. The administrator wants to ensure that the firewall can present a valid certificate to internal users for any website they visit, without manually importing each website's certificate. Which configuration is required to achieve this?
⚠ Common exam trap
Candidates often confuse SSL Forward Proxy with SSL Inbound Inspection, or mixing up the roles of Forward Trust and Forward Untrust certificates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSL Forward Proxy and configure a Forward Trust certificate.
SSL Forward Proxy decryption requires a Forward Trust certificate, which the firewall uses to generate certificates for external sites on the fly. This certificate must be trusted by internal clients. The Forward Untrust certificate is used to sign certificates for sites that the firewall does not trust, but it is not the primary certificate for decryption. Inbound Inspection is for internal servers and requires their private keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL Inbound Inspection and configure a Forward Untrust certificate.
Why it's wrong here
SSL Inbound Inspection is used to decrypt traffic destined to internal servers, not outbound traffic from internal users. It requires the server's private key, which is not feasible for arbitrary external websites. The Forward Untrust certificate is used for untrusted sites in forward proxy, not for inbound inspection.
- ✗
Enable SSL Forward Proxy and configure a Forward Untrust certificate.
Why it's wrong here
The Forward Untrust certificate is used by the firewall to sign certificates for sites that the firewall does not trust, but it is not the primary certificate for decryption. The Forward Trust certificate is used for sites that the firewall trusts, and it is required for decryption to work properly.
- ✓
Enable SSL Forward Proxy and configure a Forward Trust certificate.
Why this is correct
SSL Forward Proxy requires a Forward Trust certificate to sign the certificates presented to internal clients. This certificate must be trusted by the clients, and the firewall uses it to dynamically generate certificates for external sites, allowing decryption without importing each site's certificate.
- ✗
Enable SSL Inbound Inspection and configure a Forward Trust certificate.
Why it's wrong here
SSL Inbound Inspection is for decrypting traffic to internal servers, not outbound traffic. It requires the server's certificate and private key, which cannot be used for arbitrary external sites. A Forward Trust certificate is used in forward proxy, not inbound inspection.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.