PCNSE Core Concepts and Architecture Practice Question
A company uses a Palo Alto Networks firewall to decrypt all outbound SSL traffic. Recently, users have reported slow internet performance. The network administrator notices that the firewall's CPU utilization is consistently above 90%. The traffic logs show that a large portion of decrypted traffic is from software update services (e.g., Windows Update, Adobe, etc.) that do not require inspection. The firewall is a mid-range model with hardware decryption acceleration. What is the most effective action to reduce CPU usage while maintaining security?
⚠ Common exam trap
Candidates often assume hardware decryption offload is not already enabled or that adding HA will magically balance load, when in fact the question explicitly states hardware acceleration is present and active/passive HA does not distribute processing load.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a decryption policy exception to exclude high-volume, low-risk services from decryption.
Excluding high-volume, low-risk services like Windows Update and Adobe updates from SSL decryption reduces the CPU load from decrypting traffic that does not require security inspection. This approach maintains security by focusing decryption resources on traffic that poses a genuine risk, while leveraging the firewall's ability to bypass decryption for trusted sources. The mid-range model's hardware deceleration is already in use, so the most effective step is to reduce the volume of decryption itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a decryption policy exception to exclude high-volume, low-risk services from decryption.
Why this is correct
This reduces the decryption load significantly while still protecting against threats from other sites.
- ✗
Increase the decryption session buffer size in the SSL/TLS proxy settings.
Why it's wrong here
Buffer size affects memory, not CPU; it would not reduce CPU utilization.
- ✗
Enable hardware decryption offload on the firewall.
Why it's wrong here
The firewall already has hardware acceleration; enabling it further may not be possible or may already be active.
- ✗
Add an additional firewall in an active/passive HA pair to distribute the decryption load.
Why it's wrong here
Adding hardware is expensive and configuration changes may be complex; better to optimize policy first.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.