PCNSA Decryption and Monitoring Practice Question
A university uses a Palo Alto Networks firewall to protect its network. They have implemented SSL Forward Proxy decryption for all student traffic. Recently, the IT helpdesk has received complaints from students that some websites (e.g., online banking, healthcare portals) are not loading properly. The firewall logs show that these sites are being decrypted, and no threats are detected. The university's legal team has advised that decryption of financial and healthcare sites may violate regulations. The network team wants to quickly resolve the issue while ensuring compliance. What is the best course of action?
⚠ Common exam trap
Candidates often confuse security policy rules with decryption policy rules, thinking that a security rule can bypass decryption, when in fact decryption is controlled exclusively by decryption policy rules with actions like 'Decrypt' or 'No Decrypt'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.
It creates a decryption policy rule with action 'No Decrypt' for the specific URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule. This ensures that traffic to these sensitive categories is excluded from SSL Forward Proxy decryption, resolving the loading issues caused by certificate pinning or regulatory violations, while still decrypting all other student traffic. The rule order is critical because Palo Alto Networks decryption policies are evaluated top-down, and the first match determines the action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the existing decrypt rule to decrypt all categories except those two.
Why it's wrong here
Excluding categories from the decrypt rule still requires SSL Forward Proxy to inspect those flows, so the compliance breach persists; the fix is a no-decrypt policy for those categories. Category-based exceptions within a decrypt rule suit scenarios where only specific traffic must remain encrypted for performance, not regulatory exclusion.
- ✗
Disable decryption entirely for all student traffic.
Why it's wrong here
Disabling decryption for all student traffic removes visibility across every category, not just the regulated financial and healthcare sites, so threat inspection is lost unnecessarily. A no-decrypt policy scoped to those URL categories preserves inspection elsewhere; full disablement suits environments where decryption is legally prohibited entirely.
- ✗
Create a security policy rule to allow traffic to those URL categories without inspection.
Why it's wrong here
An allow rule without inspection still matches traffic already decrypted by the SSL Forward Proxy rule, so financial and healthcare sessions remain decrypted, breaching the legal advice. No-decrypt policy is the correct mechanism; allow-without-inspection suits trusted internal applications where decryption is unnecessary.
- ✓
Create a decryption policy rule with action 'No Decrypt' for URL categories 'Financial Services' and 'Health and Medicine', placed above the existing decrypt rule.
Why this is correct
SSL Forward Proxy decrypts everything by default, so the compliance breach stems from the decrypt rule itself. A 'No Decrypt' rule for Financial Services and Health and Medicine, positioned above the existing decrypt rule, makes the firewall bypass decryption for those categories, restoring site functionality and satisfying the legal constraint.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.