PCNSA Securing Traffic Practice Question
An organization implements SSL Forward Proxy to decrypt outbound HTTPS traffic, with a security rule that includes Vulnerability Protection and Anti-Malware profiles. Despite this, certain malware downloaded over HTTPS is not being blocked. The administrator observes that the traffic is decrypted and matches the security rule. The decryption policy excludes decryption for financial services category. The malware is delivered from a known malicious domain that is not in the financial services category. The analysis shows that the malware uses a custom packer that is not recognized by the current Anti-Malware signatures. What is the most likely reason the malware bypasses detection? The decryption exclusion list includes the domain of the malware source. The Anti-Malware profile is set to 'default' which may not block unknown malware effectively. The firewall is missing the latest content updates for WildFire. The security rule uses application 'ssl' but not 'web-browsing' for the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.
The Anti-Malware profile set to 'default' relies on known signatures and may not detect malware using a custom packer that is not recognized. The default profile does not include advanced analysis like WildFire, which could identify unknown threats. Option A is incorrect because using application 'ssl' is appropriate for decrypted SSL traffic; the traffic is correctly identified. Option B is incorrect because while content updates for WildFire are important, the primary issue is the profile not leveraging WildFire analysis; the default profile may not send samples to WildFire even with latest updates. Option C is incorrect because the decryption exclusion list does not include the domain; the malware source is not in the financial services category.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security rule uses application 'ssl' but not 'web-browsing' for the traffic.
Why it's wrong here
The application 'ssl' correctly identifies the encrypted web traffic; 'web-browsing' would be unnecessary as it is a subapplication.
- ✗
The firewall is missing the latest content updates for WildFire.
Why it's wrong here
Even with latest updates, if WildFire is not enabled in the profile, it won't submit unknown files.
- ✗
The decryption exclusion list includes the domain of the malware source.
Why it's wrong here
The domain is not in the financial services category, so it is decrypted.
- ✓
The Anti-Malware profile is set to 'default' which may not block unknown malware effectively.
Why this is correct
The default profile uses only local signatures; without WildFire analysis, new or customized malware can bypass.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.