PCNSA Decryption and Monitoring Practice Question
Which TWO of the following are best practices for configuring SSL Forward Proxy decryption? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exclude traffic to financial and healthcare sites from decryption.
Best practices for SSL Forward Proxy decryption include excluding sensitive traffic to financial and healthcare sites to avoid compliance issues and performance overhead, and installing the firewall's CA certificate on all client devices to prevent certificate errors and ensure trust. Therefore, options C and E are correct. Option A is incorrect because using a self-signed certificate can cause trust issues; a CA-signed certificate is recommended. Option B is incorrect because decrypting all internal traffic, including server-to-server, can create unnecessary overhead and privacy concerns. Option D is incorrect because decrypting all outbound traffic without exclusions can lead to performance degradation and legal issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a self-signed certificate for decryption.
Why it's wrong here
Self-signed certs cause trust issues; use CA-signed.
- ✗
Decrypt all internal traffic including server-to-server.
Why it's wrong here
Internal traffic often has performance and compatibility issues.
- ✓
Exclude traffic to financial and healthcare sites from decryption.
Why this is correct
Compliance requirements often prohibit decryption of sensitive sites.
- ✗
Decrypt all outbound traffic regardless of destination.
Why it's wrong here
Not a best practice; selective decryption reduces overhead.
- ✓
Install the firewall's CA certificate on all client devices.
Why this is correct
Ensures clients trust the decrypted connections.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PCNSA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to decrypt all SSL traffic from internal users to external websites. They have deployed a Palo Alto Networks firewall in forward proxy mode and installed a trusted root CA certificate on all endpoints. Users, however, are complaining about certificate errors when accessing HTTPS sites. Which configuration step is most likely missing?
easy- A.The decryption profile is set to block sessions with untrusted certificates.
- B.The firewall is performing inbound inspection instead of forward proxy.
- ✓ C.The firewall's decryption certificate is not signed by the installed root CA.
- D.No decryption profile is attached to the decryption rule.
Why C: In forward proxy decryption, the firewall generates a decryption certificate that must be signed by the trusted root CA installed on the endpoints. If the decryption certificate is self-signed or signed by a different CA, the browser will not trust it, causing certificate errors. The root CA certificate must be installed on all endpoints to establish a chain of trust for the firewall-generated certificates.
Variation 2. A company implements SSL Forward Proxy decryption. Users report that some internal applications fail to load after deployment. The firewall is configured with a CA-signed certificate for decryption. What is the most likely cause of the application failures?
medium- A.The decryption policy uses 'No Decrypt' for the internal application's URL category.
- B.The decryption policy is set to 'Decrypt' for all traffic, causing performance bottlenecks.
- ✓ C.The firewall's CA certificate is not installed in the trusted root store on user endpoints.
- D.The firewall is configured to decrypt traffic from the internal zone, but not the external zone.
Why C: SSL Forward Proxy decryption requires the firewall's CA certificate to be trusted by client endpoints. When the firewall generates a new certificate for the internal application's server, the client must trust the firewall's CA to avoid certificate validation errors. Without the CA in the trusted root store, browsers and applications will reject the connection, causing failures for internal applications that rely on SSL/TLS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.