PCNSA Decryption and Monitoring Practice Question
Exhibit
Refer to the exhibit.
{
"decryption_rules": [
{
"name": "rule1",
"source_zone": ["trust"],
"destination_zone": ["untrust"],
"source_address": ["any"],
"destination_address": ["any"],
"category": ["financial-services"],
"action": "no-decrypt",
"description": "Skip decryption for finance sites"
},
{
"name": "rule2",
"source_zone": ["trust"],
"destination_zone": ["untrust"],
"source_address": ["any"],
"destination_address": ["any"],
"category": ["any"],
"action": "decrypt",
"description": "Decrypt all other traffic"
}
]
}Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?
⚠ Common exam trap
A common mix-up: candidates assume any HTTPS session must be decrypted for inspection, but the 'No Decrypt' action explicitly bypasses decryption while still allowing the session through, which is a common configuration for regulated or sensitive traffic categories.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No Decrypt (bypass decryption)
The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error due to rule conflict
Why it's wrong here
No conflict; first match applies.
- ✗
Block
Why it's wrong here
No block action in decryption rules.
- ✓
No Decrypt (bypass decryption)
Why this is correct
Rule1 matches financial-services and action is no-decrypt.
- ✗
Decrypt
Why it's wrong here
Rule2 would decrypt if rule1 did not match, but rule1 matches.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.