Courseiva
← PCNSA
Full test
Decryption and Monitoring →mediumMultiple ChoiceObjective-mapped

PCNSA Decryption and Monitoring Practice Question

Exhibit

admin@PA-3020> show running decryption policy

Decryption Policy:
  #  Name              Source Zone   Dest Zone    Source User   Destination   Service   Action
  1  No-Decrypt-Int    internal       external       any          any           any       no-decrypt
  2  Decrypt-Corp       internal       external       corp-users   any           service-https   decrypt
  3  Decrypt-All        external       internal       any          any           service-https   decrypt
  4  Block-No-Decrypt  internal       external       any          any           any       block

Refer to the exhibit. A security analyst wants to ensure that all HTTPS traffic from internal users to the internet is decrypted for inspection. However, traffic from the 'corp-users' group is being blocked instead of decrypted. Which configuration change should be made?

⚠ Common exam trap

Palo Alto Networks often tests the concept that policy order matters in decryption and security rules, and the trap here is that candidates may focus on the action (block vs. decrypt) rather than the rule sequence, leading them to incorrectly choose to modify the block rule's action instead of reordering the rules.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Move rule 2 above rule 1.

In a Palo Alto Networks firewall, decryption policies are evaluated in order from top to bottom, and the first matching rule is applied. Since rule 1 (which blocks corp-users traffic) is above rule 2 (which decrypts traffic), the block action is taken before the decryption rule can be evaluated. Moving rule 2 above rule 1 ensures that decryption is applied first to corp-users traffic, allowing inspection before any blocking action.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Add a new rule above rule 1 to decrypt corp-users traffic.

    Why it's wrong here

    Adding a new rule is unnecessary; simply reordering the existing rules achieves the goal without adding complexity.

  • ✓

    Move rule 2 above rule 1.

    Why this is correct

    Currently rule 1 (no-decrypt) is first and matches all internal to external traffic, so traffic from corp-users matches rule 1 and is not decrypted. Then rule 4 blocks undecrypted traffic. Moving rule 2 above rule 1 ensures that corp-users traffic matches the decrypt rule first.

  • ✗

    Change rule 4 to 'allow' instead of 'block'.

    Why it's wrong here

    This would allow undecrypted traffic, defeating the purpose of decryption.

  • ✗

    Change rule 2 to use 'any' for source user.

    Why it's wrong here

    This would decrypt all internal users, but the issue is that traffic is being blocked, not that it's not matching.

About these practice questions

Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.