Courseiva
← PCNSA
Full test
Decryption and Monitoring →hardMultiple ChoiceObjective-mapped

PCNSA Decryption and Monitoring Practice Question

Exhibit

admin@PA-220> show session all
Total sessions: 3

ID   Application      State   Type   Src IP:Port      Dst IP:Port          Protocol   Ingress   Egress
1    ssl              ACTIVE  FLOW   10.0.0.1:44321   192.168.1.100:443     tcp        eth1/1    eth1/2
2    web-browsing     ACTIVE  FLOW   10.0.0.2:53241   192.168.1.200:80      tcp        eth1/1    eth1/2
3    dns              ACTIVE  FLOW   10.0.0.3:45321   8.8.8.8:53            udp        eth1/1    eth1/3

admin@PA-220> show running security-policy
name    from    to      source      destination    application    action   decrypt
POL-1   trust   untrust 10.0.0.0/24 192.168.1.0/24 ssl            allow    forward-proxy
POL-2   trust   untrust 10.0.0.0/24 any             web-browsing   allow    no-decrypt
POL-3   trust   untrust 10.0.0.0/24 any             dns            allow    no-decrypt

admin@PA-220> show decryption statistics
Forward Proxy SSL/TLS Decryption: 0 sessions, 0 bytes decrypted

Refer to the exhibit. A security engineer observes that SSL decryption is not working for session 1. The policy and session table are shown. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The decryption policy requires a certificate that is not installed on the firewall.

The session table shows an SSL session from 10.0.0.1 to 192.168.1.100:443, which matches POL-1 (forward-proxy). However, the decryption statistics show 0 sessions decrypted. The most likely cause is that the decryption policy requires a certificate to be imported and configured, and the firewall cannot perform decryption without a valid certificate. Other options (like policy order or application mismatch) are not supported by the exhibit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    The decryption policy requires a certificate that is not installed on the firewall.

    Why this is correct

    For forward-proxy decryption, the firewall must have a CA certificate installed to generate session certificates. If no certificate is present, decryption will not occur, and sessions will be allowed without decryption.

  • ✗

    The security policy is configured to allow SSL, but the decryption policy is not configured to decrypt SSL traffic.

    Why it's wrong here

    The exhibit shows POL-1 has action 'forward-proxy', which means decryption is enabled in the security policy. However, the issue may be elsewhere.

  • ✗

    The destination IP 192.168.1.100 is not in the decryption policy's destination list.

    Why it's wrong here

    POL-1 has destination 192.168.1.0/24, which includes 192.168.1.100.

  • ✗

    The firewall is not receiving the SSL handshake because the session is already established.

    Why it's wrong here

    The session is in ACTIVE state and the firewall sees the SSL application, so it receives the handshake.

About these practice questions

Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.