Courseiva
← PCNSA
Full test
Decryption and Monitoring →mediumMultiple ChoiceObjective-mapped

PCNSA Decryption and Monitoring Practice Question

Exhibit

admin@PA-220> show logging system | match ssl

2023-06-15 10:23:45 severity=warning msg="SSL decryption: certificate validation failed for session 12345, server certificate expired"
2023-06-15 10:24:01 severity=info msg="SSL decryption: session 12346 decrypted successfully"
2023-06-15 10:24:15 severity=warning msg="SSL decryption: session 12347 failed, unsupported protocol version"

Refer to the exhibit. An administrator notices that some HTTPS sessions are not being decrypted. Which configuration change would address the most common cause of decryption failures shown?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable 'allow expired certificates' in the SSL decryption profile.

The log shows a warning about an expired server certificate causing decryption failure. By enabling 'allow expired certificates' in the decryption profile, the firewall will continue to decrypt traffic even if the server certificate is expired.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Enable 'allow expired certificates' in the SSL decryption profile.

    Why this is correct

    The warning indicates an expired server certificate. Enabling 'allow expired certificates' will permit decryption even if the server certificate is expired.

  • ✗

    Configure a forward trust certificate that is valid and trusted.

    Why it's wrong here

    The log shows certificate validation failure due to expired server certificate, not forward trust certificate.

  • ✗

    Increase the session timeout for decryption.

    Why it's wrong here

    Session timeout does not affect certificate validation.

  • ✗

    Enable support for SSLv3 in the decryption profile.

    Why it's wrong here

    SSLv3 is outdated and insecure; unsupported protocol version is only one failure.

About these practice questions

Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.