PCNSA Decryption and Monitoring Practice Question
Exhibit
> show system info | match cert cert-management-status: OK certificate-expiry-warning: cert 'Decrypt-CA' expires in 30 days
Refer to the exhibit. The firewall raises a certificate expiry warning for the decryption CA. Which action is required?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between the decryption CA certificate (which must be renewed) and server certificates (which are imported for specific sites), leading candidates to mistakenly choose importing a new server certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Renew the decryption CA certificate before expiry
The decryption CA certificate is used by the firewall to generate and sign internal server certificates for SSL decryption. When it expires, the firewall can no longer create new decryption certificates, causing SSL decryption to fail for new sessions. Renewing the decryption CA certificate before expiry ensures uninterrupted decryption and avoids certificate validation errors for clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Renew the decryption CA certificate before expiry
Why this is correct
The CA certificate must be valid for decryption to work; it should be renewed.
- ✗
Ignore the warning as it is only informational
Why it's wrong here
The warning is a proactive alert; ignoring it may lead to decryption failures after expiry.
- ✗
Import a new server certificate
Why it's wrong here
Server certificates are for inbound inspection; the warning is about the CA used for forward proxy.
- ✗
Disable decryption until renewal
Why it's wrong here
Disabling decryption is not required; renewal can be done proactively.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.