Courseiva
Decryption and MonitoringmediumMultiple ChoiceObjective-mapped

PCNSA Decryption and Monitoring Practice Question

Exhibit

Refer to the exhibit.

{
  "decryption_rules": [
    {
      "name": "rule1",
      "source_zone": ["trust"],
      "destination_zone": ["untrust"],
      "source_address": ["any"],
      "destination_address": ["any"],
      "category": ["financial-services"],
      "action": "no-decrypt",
      "description": "Skip decryption for finance sites"
    },
    {
      "name": "rule2",
      "source_zone": ["trust"],
      "destination_zone": ["untrust"],
      "source_address": ["any"],
      "destination_address": ["any"],
      "category": ["any"],
      "action": "decrypt",
      "description": "Decrypt all other traffic"
    }
  ]
}

Refer to the exhibit. A user in the trust zone accesses a banking site (category: financial-services). What action will the firewall take on this HTTPS session?

⚠ Common exam trap

A common mix-up: candidates assume any HTTPS session must be decrypted for inspection, but the 'No Decrypt' action explicitly bypasses decryption while still allowing the session through, which is a common configuration for regulated or sensitive traffic categories.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

No Decrypt (bypass decryption)

The firewall is configured with a decryption policy that matches the banking site (financial-services category) and has the action set to 'No Decrypt'. This action explicitly bypasses SSL/TLS decryption for the session, allowing the HTTPS traffic to pass through without inspection. The user in the trust zone accessing the site will therefore have the session proceed without decryption.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Error due to rule conflict

    Why it's wrong here

    No conflict; first match applies.

  • Block

    Why it's wrong here

    No block action in decryption rules.

  • No Decrypt (bypass decryption)

    Why this is correct

    Rule1 matches financial-services and action is no-decrypt.

  • Decrypt

    Why it's wrong here

    Rule2 would decrypt if rule1 did not match, but rule1 matches.

About these practice questions

Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.