PCNSA Securing Traffic Practice Question
An organization has implemented SSL forward proxy decryption. Users on Windows workstations report that many HTTPS sites show certificate errors. The firewall's decryption policy is configured correctly. What is the most likely cause?
⚠ Common exam trap
The trap is blaming the firewall configuration (policy, CRL, per-site certs) when the actual failure is client-side trust — candidates forget that forward proxy decryption requires the firewall's CA to be installed on every endpoint, and pick a firewall-side answer instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's CA certificate is not installed in the trusted root certificate store on client workstations.
In SSL forward proxy decryption, the firewall intercepts the client's HTTPS connection and presents a certificate it generates on the fly, signed by the firewall's own CA. For clients to trust this dynamically generated certificate, the firewall's CA certificate must be installed in the trusted root certificate store of every client workstation. If it is missing, browsers will show certificate errors for every decrypted HTTPS site, even though the decryption policy itself is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall's CA certificate is not installed in the trusted root certificate store on client workstations.
Why this is correct
SSL forward proxy decryption makes the firewall re-sign each HTTPS session with its own CA certificate. Unless that CA is imported into the Windows trusted root store, clients cannot build a trusted chain and raise certificate errors, despite a correctly configured decryption policy.
- ✗
The decryption policy does not specify a certificate for forward proxy.
Why it's wrong here
Forward proxy decryption uses the firewall's forward trust certificate, configured once under Device > Certificate Management, not per decryption policy rule; the policy only references profiles and URLs. It is tempting because certificate selection does appear in some decryption configurations, but omitting it here would not produce per-site errors.
- ✗
The CRL (Certificate Revocation List) is not enabled on the firewall.
Why it's wrong here
CRL checking governs whether the firewall validates revocation status of certificates it inspects; it does not cause client-side trust failures. Revocation is tempting because certificate errors sound revocation-related, but enabling CRL would be correct when the firewall rejects revoked server certificates, not when workstations distrust the proxy's certificate.
- ✗
The server certificate for each HTTPS site is missing from the client's certificate store.
Why it's wrong here
Client certificate stores hold trusted root CAs, not individual site server certificates, so importing per-site certificates is not how forward proxy trust is established. It is tempting because untrusted-certificate errors do involve trust stores, but the fix is distributing the firewall's forward trust certificate to clients.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.