Courseiva
← PCNSA
Full test
Decryption and Monitoring →hardMultiple ChoiceObjective-mapped

PCNSA Decryption and Monitoring Practice Question

Exhibit

admin@PA-5250> show ssl-decrypt statistics

SSL Decryption Statistics:
  Total Sessions Inspected: 15000
  Sessions Decrypted Successfully: 12000
  Sessions Failed: 3000
    - SSL Handshake Failure: 2000
    - Certificate Validation Failure: 500
    - Unsupported Cipher: 300
    - Other: 200

admin@PA-5250> show ssl-decrypt certificate cache

Certificate Cache: size 10000, active 9500
  Forward Trust Certificate: CN=PA-Forward-Trust
  Forward Untrust Certificate: CN=PA-Forward-Untrust

Refer to the exhibit. A network engineer observes a high number of SSL handshake failures. Which action is most likely to reduce these failures?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Ensure the forward trust certificate is trusted by internal clients.

The majority of failures are SSL handshake failures (2000 out of 3000). A common reason is that the forward trust certificate is not trusted by clients, causing the client to reject the connection during the handshake.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Disable decryption for traffic using unsupported ciphers.

    Why it's wrong here

    Unsupported ciphers account for only 300 failures, not the majority.

  • ✗

    Reissue the forward untrust certificate with a stronger key size.

    Why it's wrong here

    The forward untrust certificate is used for untrusted certificates, not for handshake failures.

  • ✗

    Increase the certificate cache size to accommodate more certificates.

    Why it's wrong here

    The cache is almost full (9500 out of 10000), but handshake failures are not typically caused by cache size.

  • ✓

    Ensure the forward trust certificate is trusted by internal clients.

    Why this is correct

    If clients do not trust the forward trust certificate, SSL handshakes will fail. This is a common cause of handshake failures.

About these practice questions

One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.