PCNSE Core Concepts and Architecture Practice Question
A company configures its Palo Alto Networks firewall to decrypt outbound SSL traffic using a forward proxy. After applying the decryption policy, users report that their browsers display certificate errors when accessing HTTPS websites. The firewall's decryption certificate is self-signed. What is the most likely cause?
⚠ Common exam trap
Candidates often confuse the forward trust certificate (used to sign per-session certificates) with the root CA certificate that must be trusted by clients, leading them to focus on expiration or policy placement rather than the fundamental trust chain requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.
In a forward proxy decryption scenario, the firewall generates a self-signed root CA certificate and uses it to sign per-session certificates for intercepted HTTPS traffic. If that root CA certificate is not installed in the client's trusted root certificate store, the browser will treat the per-session certificates as untrusted, resulting in certificate errors. Option C directly identifies this missing trust chain as the root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall is using a forward trust certificate that is expired.
Why it's wrong here
An expired certificate would cause errors, but likely the certificate is self-signed and not trusted.
- ✗
The decryption policy is not applied to the correct security rule.
Why it's wrong here
Decryption is applied via decryption policy, not security rules; order might matter but not the cause of certificate error.
- ✓
The firewall's decryption root CA certificate has not been installed in the client's trusted root certificate store.
Why this is correct
Correct. Clients must trust the firewall's issuing CA to avoid certificate warnings.
- ✗
The decryption policy is set to 'no-decrypt' for the traffic.
Why it's wrong here
If set to no-decrypt, traffic would pass through without decryption, so no certificate error from the firewall.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.