How to Exclude Specific Domains from SSL Forward Proxy Decryption
A company is deploying SSL Forward Proxy decryption for outbound HTTPS traffic. They want to ensure that traffic to financial sites (e.g., *.bank.com) is not decrypted due to compliance requirements. Which method should be used to exclude this traffic from decryption?
Quick Answer
The correct method is to create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'. This works because Palo Alto Networks firewalls use Decryption Policy rules to govern SSL Forward Proxy decryption, where the action field determines whether traffic is intercepted or bypassed. By specifying the destination domain, such as *.bank.com, and applying the 'No Decrypt' action, the firewall forwards the encrypted traffic untouched, preserving compliance requirements for sensitive financial sites. On the PCNSE exam, this scenario tests your understanding of Decryption Policy rule order and action types—a common trap is confusing 'No Decrypt' with a Security Policy allow rule, but decryption exclusion must be handled at the Decryption Policy layer, not the Security Policy. Remember the memory tip: "No Decrypt for domains you decrypt no more"—think of it as a policy-level bypass that keeps the handshake intact without inspection.
⚠ Common exam trap
Test-takers frequently confuse the purpose of Decryption Profiles (which control decryption behavior) with Decryption Policy rules (which control which traffic is decrypted), leading candidates to incorrectly select Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'.
In Palo Alto Networks firewalls, SSL Forward Proxy decryption is controlled by Decryption Policy rules. To exclude specific traffic from decryption, you create a Decryption Policy rule that matches the traffic (e.g., destination domain *.bank.com) and set the action to 'No Decrypt'. This ensures the firewall forwards the traffic without intercepting or decrypting it, meeting compliance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the SSL/TLS Service Profile to bypass decryption for the domain.
Why it's wrong here
The SSL/TLS Service Profile is used for inbound decryption and proxy settings, not for policy exclusion.
- ✗
Configure a Decryption Profile to exclude the domain.
Why it's wrong here
Decryption Profiles control cipher settings and certificate validation, not policy exclusion.
- ✓
Create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'.
Why this is correct
Decryption Policy rules with 'No Decrypt' action are the correct way to exclude traffic from decryption based on zone, URL category, etc.
- ✗
Enable certificate revocation checking for the decryption zone.
Why it's wrong here
Certificate revocation checking is unrelated to excluding traffic from decryption.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?
medium- A.Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.
- ✓ B.Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.
- C.Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.
- D.Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.
Why B: It follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.