PCNSA Decryption and Monitoring Practice Question
Exhibit
> show system info | match cert cert-management-status: OK certificate-expiry-warning: cert 'Decrypt-CA' expires in 30 days
Refer to the exhibit. The firewall raises a certificate expiry warning for the decryption CA. Which action is required?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between the decryption CA certificate (which must be renewed) and server certificates (which are imported for specific sites), leading candidates to mistakenly choose importing a new server certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Renew the decryption CA certificate before expiry
The decryption CA certificate is used by the firewall to generate and sign internal server certificates for SSL decryption. When it expires, the firewall can no longer create new decryption certificates, causing SSL decryption to fail for new sessions. Renewing the decryption CA certificate before expiry ensures uninterrupted decryption and avoids certificate validation errors for clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Renew the decryption CA certificate before expiry
Why this is correct
Renewing the decryption CA certificate before expiry directly resolves the warning, since the firewall validates the CA's own validity period when performing SSL forward proxy decryption. An expired CA breaks the trust chain for all forged site certificates, so renewal preserves uninterrupted decryption. This satisfies the stem's requirement to clear the expiry warning.
- ✗
Ignore the warning as it is only informational
Why it's wrong here
The warning signals that the decryption CA certificate has expired, so inbound and outbound SSL inspection will fail once it lapses. Ignoring it leaves decryption broken. It is tempting because some warnings are advisory, but an expired CA is an operational fault requiring renewal, not dismissal.
- ✗
Import a new server certificate
Why it's wrong here
The warning concerns the decryption CA certificate, so the replacement must be a CA certificate imported into the certificate store, not a server certificate. Server certificates are tempting because they are the usual objects imported for decryption, but they secure individual services rather than re-establishing the trusted CA chain.
- ✗
Disable decryption until renewal
Why it's wrong here
Disabling decryption halts the very traffic inspection the firewall exists to perform, and it does not renew the CA. It is tempting because it silences the warning immediately, but the correct action is to renew or replace the expired decryption CA certificate so decryption continues uninterrupted.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.