PCNSA Decryption and Monitoring Practice Question
Exhibit
admin@PA-220> show running security-policy name from to source destination application action decrypt POL-1 trust untrust 10.0.0.0/24 any ssl allow no-decrypt POL-2 trust untrust 10.0.0.0/24 192.168.1.0/24 ssl allow forward-proxy POL-3 trust untrust 10.0.0.0/24 any web-browsing allow no-decrypt admin@PA-220> show session all Total sessions: 1 ID Application State Type Src IP:Port Dst IP:Port Protocol Ingress Egress 1 ssl ACTIVE FLOW 10.0.0.5:44321 192.168.1.50:443 tcp eth1/1 eth1/2
Refer to the exhibit. A user at 10.0.0.5 is accessing https://internal-server (192.168.1.50:443). The administrator wants to decrypt this traffic but notices it is not being decrypted. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security policy order is incorrect; POL-1 matches the traffic first and disables decryption.
The session matches the destination 192.168.1.50, which is within the destination range of POL-2 (192.168.1.0/24) and has decrypt action forward-proxy. However, the session is matching POL-1 first because security policies are evaluated top-down. POL-1 has no-decrypt and matches all destinations, so the traffic hits POL-1 and is not decrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security policy order is incorrect; POL-1 matches the traffic first and disables decryption.
Why this is correct
Since POL-1 is above POL-2 and matches the traffic (source 10.0.0.0/24, destination any, application ssl), the action 'no-decrypt' applies, bypassing POL-2.
- ✗
The user's IP is not in the source range of POL-2.
Why it's wrong here
10.0.0.5 is within 10.0.0.0/24.
- ✗
The application is not correctly identified as SSL.
Why it's wrong here
The session shows application ssl, so identification is correct.
- ✗
The decryption policy is not configured for the destination.
Why it's wrong here
POL-2 has decryption configured for that destination.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.