PCNSA Decryption and Monitoring Practice Question
Exhibit
admin@PA-220> show system log | tail -20 2024-06-15 11:00:01 threat url example.com spyware blocked high 2024-06-15 11:00:02 threat url badsite.com malware blocked critical 2024-06-15 11:00:03 system config commit admin success admin@PA-220> show url-filtering statistics URL Filtering Profile: strict-profile Total requests: 1500 Blocked: 45 Allowed: 1455 Categories: malware, spyware, phishing admin@PA-220> show decryption statistics Forward Proxy SSL/TLS Decryption: 1200 sessions, 45 MB decrypted admin@PA-220> show running global-protect No GlobalProtect configured
Refer to the exhibit. A security analyst notices that URL filtering is blocking some requests, but decryption is working. What can be concluded about the traffic that is being decrypted?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The URL filtering profile is applied to the same rule that enables decryption.
The URL filtering statistics show total requests and blocked counts, but decryption statistics show 1200 sessions decrypted. The exhibit does not provide a direct correlation between decrypted sessions and URL filtering. However, since URL filtering inspects HTTP/HTTPS traffic, decryption enables it to see encrypted payloads. The blocked URLs (malware, spyware) likely come from decrypted sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The URL filtering profile is applied to the same rule that enables decryption.
Why this is correct
Typically, URL filtering is applied via security policy rules. The fact that decryption and URL filtering are both active suggests they are configured in the same rule, allowing URL filtering to inspect decrypted traffic.
- ✗
The firewall is decrypting traffic but not inspecting it for threats.
Why it's wrong here
The URL filtering statistics show blocked requests, indicating inspection is happening.
- ✗
All decrypted traffic is inspected by URL filtering.
Why it's wrong here
While decryption enables URL filtering to inspect encrypted traffic, the exhibit does not confirm that all decrypted traffic is subject to URL filtering; there could be other profiles.
- ✗
GlobalProtect is required for decryption to work.
Why it's wrong here
GlobalProtect is not related to decryption; the exhibit shows no GlobalProtect configured, yet decryption works.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.