PCNSA Decryption and Monitoring Practice Question
A security analyst needs to monitor decryption performance and identify sessions that are bypassing decryption due to policy or technical reasons. Which two monitoring tools or methods can provide this insight?
⚠ Common exam trap
It's easy for candidates to confuse traffic logs with decryption logs, or assume that system logs contain decryption session details, when in fact decryption-specific logs and the ACC Decryption Overview are the correct sources for monitoring bypass activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decryption logs with filter 'decryption action not equal to decrypt'
Decryption logs with a filter for 'decryption action not equal to decrypt' will show sessions that were not decrypted, including those bypassed due to policy (e.g., excluded URLs) or technical reasons (e.g., unsupported cipher suites). Option C is correct because the ACC > Decryption Overview provides a dashboard that visualizes decryption performance metrics, such as the number of sessions bypassed, decrypted, or failed, giving the analyst a high-level view of bypass activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Decryption logs with filter 'decryption action not equal to decrypt'
Why this is correct
Decryption logs can be filtered to show sessions where decryption was not performed, including bypass reasons.
- ✗
System logs with filter 'decryption bypass'
Why it's wrong here
System logs do not contain decryption bypass events.
- ✓
ACC (Application Command Center) > Decryption Overview
Why this is correct
ACC Decryption Overview provides a dashboard with decryption metrics and bypass reasons.
- ✗
Traffic logs with filter 'action equals decrypt' and 'reason equals bypass'
Why it's wrong here
Traffic logs do not have a 'reason' field for decryption bypass; instead use Decryption logs.
- ✗
Packet capture on the decryption port
Why it's wrong here
Packet capture is for detailed traffic analysis, not for monitoring decryption bypasses at scale.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.