PCNSA Decryption and Monitoring Practice Question

Exhibit

{
  "decryption-policy": {
    "rules": [
      {
        "name": "Decrypt-HTTPs-Corp",
        "source-zones": ["internal"],
        "dest-zones": ["external"],
        "source-users": ["corp-users"],
        "destination-addresses": ["any"],
        "service": ["service-https"],
        "action": "decrypt",
        "decryption-profile": "Standard-Decrypt"
      }
    ]
  },
  "decryption-profile": {
    "name": "Standard-Decrypt",
    "ssl-decrypt-settings": {
      "forward-trust-cert": "PA-Forward-Trust",
      "forward-untrust-cert": "PA-Forward-Untrust",
      "decrypt-unknown-protocol": false,
      "ssl-protocol-settings": {
        "min-version": "tls1-0",
        "max-version": "tls1-2"
      }
    }
  }
}

Refer to the exhibit. An administrator configures decryption for HTTPS traffic from internal users. However, traffic using TLS 1.3 is not being decrypted. Which change should be made to decrypt TLS 1.3 traffic?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the 'ssl-protocol-settings' max-version to 'tls1-3'.

The decryption profile specifies max-version as tls1-2, which prevents decryption of TLS 1.3 traffic. Updating the max-version to tls1-3 allows decryption of TLS 1.3 sessions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Change the min-version to 'tls1-3'.
Why it's wrong here
Setting min-version to tls1-3 would reject older TLS versions, but the max-version still needs to be updated.
✗
Add a new rule for TLS 1.3 traffic.
Why it's wrong here
The rule matches service-https, which includes all HTTPS regardless of TLS version. The issue is the profile settings.
✓
Change the 'ssl-protocol-settings' max-version to 'tls1-3'.
Why this is correct
The profile currently restricts max version to TLS 1.2. To decrypt TLS 1.3, the max version must be set to tls1-3.
✗
Enable 'decrypt-unknown-protocol' to capture all traffic.
Why it's wrong here
TLS 1.3 is a known protocol; this setting is for non-SSL/TLS traffic.

Go deeper

PCNSA Decryption and Monitoring Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question