PCNSA Decryption and Monitoring Practice Question
Exhibit
Refer to the exhibit. ``` admin@PA-500> show log traffic | match 10.0.0.5 Time Source Dest Application Action Decrypted 2023/01/01 10.0.0.5 192.168.1.1 ssl allow yes 2023/01/01 10.0.0.5 8.8.8.8 dns allow no ```
An administrator sees the above traffic log entries. What can be concluded about the traffic to 192.168.1.1?
⚠ Common exam trap
Palo Alto Networks often tests the misconception that SSL application traffic is automatically decrypted, but in reality, decryption requires an explicit policy rule; the trap here is confusing application identification with policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic was decrypted because it matched a decryption policy.
The traffic log entries indicate that the session to 192.168.1.1 was decrypted, as shown by the decryption flag or action field (e.g., 'decrypt'). This occurs when the traffic matches a decryption policy configured on the firewall, typically for SSL/TLS inspection. The destination being internal (192.168.1.1) and the application being SSL are not sufficient conditions for decryption; a matching decryption rule is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The traffic was decrypted because it matched a decryption policy.
Why this is correct
The 'Decrypted: yes' field indicates decryption was applied.
- ✗
The traffic was decrypted because the application is SSL.
Why it's wrong here
While SSL is required for decryption, the policy is what triggers it.
- ✗
The traffic was not decrypted because it matched a no-decrypt policy.
Why it's wrong here
The log shows 'yes' for decrypted.
- ✗
The traffic was not decrypted because the destination is external.
Why it's wrong here
The destination is internal (192.168.1.1) and decrypted anyway.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.