PCNSA Decryption and Monitoring Practice Question

Exhibit

Refer to the exhibit.
```
admin@PA-500> show running decryption-policy
Decryption policy:
  #  name              from      to        source        destination    service    action       profile
  1  decrypt-all       trust     untrust   any           any            any        decrypt      default
  2  no-decrypt-fin    trust     untrust   10.0.0.0/24   192.168.1.0/24 any        no-decrypt   none
  3  decrypt-inbound   untrust   trust     any           10.0.0.5/32   https      decrypt      inbound
```

A user at IP 10.0.0.10 is accessing a server at 192.168.1.5. According to the decryption policy, what will happen to the traffic?

⚠ Common exam trap

Palo Alto Networks often tests the misconception that decryption policy can block traffic or that a no-decrypt rule still applies a profile; the trap here is confusing decryption policy actions (decrypt/no-decrypt) with security policy actions (allow/deny).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The traffic will not be decrypted because of the no-decrypt rule.

The decryption policy contains a no-decrypt rule that matches traffic from source IP 10.0.0.10 to destination IP 192.168.1.5. Since the no-decrypt rule explicitly excludes this traffic from decryption, the firewall will forward the traffic without applying any decryption profile. This is the correct behavior because no-decrypt rules take precedence over decrypt rules for matching traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The traffic will be decrypted using the default profile.
Why it's wrong here
Rule 2 matches first and has action no-decrypt.
✓
The traffic will not be decrypted because of the no-decrypt rule.
Why this is correct
Rule 2 matches the traffic exactly and sets no-decrypt.
✗
The traffic will be decrypted using the inbound profile.
Why it's wrong here
Inbound profile is for rule 3, which applies to untrust-to-trust traffic.
✗
The traffic will be blocked because no security rule allows it.
Why it's wrong here
Security policies are separate; this output only shows decryption policy.

Go deeper

PCNSA Decryption and Monitoring Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question