PCNSA Securing Traffic Practice Question
Which THREE components are required to successfully decrypt outbound SSL traffic using forward proxy? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A root CA certificate installed in the trusted root store on client devices.
Options A, D, and E are correct. A root CA certificate installed on client devices is required so clients trust the firewall's generated certificates. A decryption policy rule defines which traffic to decrypt. A decryption profile specifies the forward proxy certificate (CA certificate) used by the firewall. Option B is incorrect because the firewall does not need the private key of each destination server; it generates its own certificate for the session. Option C is incorrect because the server certificate is not required on clients for forward proxy decryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A root CA certificate installed in the trusted root store on client devices.
Why this is correct
Clients must trust the CA that signs the decrypted sessions.
- ✗
The private key of each destination server.
Why it's wrong here
Private keys are not required for forward proxy.
- ✗
The server certificate for each destination server.
Why it's wrong here
Server certificates are not needed on clients; the firewall creates on-the-fly.
- ✓
A decryption policy rule that matches the traffic to be decrypted.
Why this is correct
The decryption policy defines which traffic to decrypt.
- ✓
A decryption profile that specifies the forward proxy certificate (CA certificate).
Why this is correct
The profile contains the certificate used to generate certs for decrypted sessions.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.