PCNSA SSL Forward Proxy Practice Question
Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)
⚠ Common exam trap
Candidates may mistakenly believe that SSH Proxy or IPsec Decryption are valid for SSL/TLS decryption, or confuse Decryption Mirror with an actual decryption method. Remember that only SSL Inbound Inspection and SSL Forward Proxy directly decrypt SSL/TLS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL Inbound Inspection
SSL Inbound Inspection (C) is a valid decryption method: the firewall is configured with the server's certificate and private key so it can decrypt traffic destined to an internal server, which is the standard approach for protecting inbound connections to your own web servers. SSL Forward Proxy (E) is also valid: the firewall acts as a man-in-the-middle, generating a forged certificate signed by a trusted CA and decrypting outbound client-initiated SSL/TLS sessions to inspect them. The other options are not decryption methods for SSL/TLS: IPsec Decryption (A) applies to IPsec VPN traffic, not SSL/TLS; SSH Proxy (B) is for controlling SSH sessions, not decrypting SSL/TLS; and Decryption Mirror (D) is a feature for copying decrypted traffic to a destination for analysis, not a method to decrypt SSL/TLS itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IPsec Decryption
Why it's wrong here
IPsec decryption applies to tunnel-encapsulated traffic terminating on the firewall, not to SSL/TLS sessions, which require the firewall to hold the server certificate and private key for forward proxy decryption. It is tempting because IPsec also encrypts payloads, and would be correct for inspecting site-to-site VPN traffic.
- ✗
SSH Proxy
Why it's wrong here
SSH Proxy decrypts outbound SSH sessions, not SSL/TLS traffic, so it cannot inspect HTTPS flows. SSL Forward Proxy and SSL Inbound Inspection are the valid decryption methods. SSH Proxy is chosen when auditing tunnelled SSH command traffic rather than web TLS.
- ✓
SSL Inbound Inspection
Why this is correct
SSL Inbound Inspection decrypts traffic destined to internal servers by installing the server's certificate and private key on the firewall, letting it terminate and inspect inbound TLS sessions. This satisfies the requirement for a valid decryption method alongside forward proxy inspection.
- ✗
Decryption Mirror
Why it's wrong here
Decryption Mirror copies decrypted traffic to a tapped interface for external capture; it does not itself decrypt traffic for inspection by the firewall's security profiles. It would be correct when feeding cleartext to a third-party analysis appliance rather than enforcing policy inline.
- ✓
SSL Forward Proxy
Why this is correct
SSL Forward Proxy decrypts outbound client-initiated TLS sessions by presenting a firewall-generated certificate to internal clients, then re-encrypting to the external server. This is the standard method for inspecting traffic leaving the network, distinct from inbound decryption.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.