PCNSE Secure Access and VPN Practice Question

Exhibit

Refer to the exhibit.

Decryption policy rule:
{
  "name": "Skip Decrypt for VPN",
  "from": ["any"],
  "to": ["any"],
  "source": ["10.0.0.0/8"],
  "destination": ["any"],
  "service": ["application-default"],
  "category": ["any"],
  "action": "no-decrypt"
}

Additionally, the GlobalProtect gateway is configured with 'Tunnel Inspection' set to 'Required'.

A GlobalProtect user behind the tunnel is unable to browse HTTPS websites. What is the issue?

⚠ Common exam trap

A common mix-up: candidates assume the issue is a missing decryption policy (Option A) or a certificate trust problem (Option C), overlooking the specific conflict between tunnel inspection and no-decrypt rules that causes SSL sessions to be dropped.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The tunnel inspection required conflicts with the no-decrypt rule, causing SSL sessions to be dropped

When a GlobalProtect tunnel is established, the firewall applies tunnel inspection to decrypt and inspect traffic inside the tunnel. If a no-decrypt rule exists (e.g., for certain traffic or users), it conflicts with the tunnel inspection requirement, causing the firewall to drop SSL sessions because it cannot both inspect and bypass decryption. This results in HTTPS websites being unreachable for the user behind the tunnel.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The firewall's decryption policy is not applied to the tunnel
Why it's wrong here
The policy is applied globally; the issue is the conflict between the rule and tunnel inspection setting.
✗
The decryption policy rule blocks traffic from 10.0.0.0/8
Why it's wrong here
The rule sets 'no-decrypt' which does not block; it bypasses decryption.
✗
The user's SSL certificate is not trusted
Why it's wrong here
SSL certificate trust issues would cause warnings, not complete inability to browse.
✓
The tunnel inspection required conflicts with the no-decrypt rule, causing SSL sessions to be dropped
Why this is correct
When tunnel inspection is required, the firewall must decrypt all SSL traffic. A no-decrypt rule forces decryption to be skipped, causing the firewall to drop the session.

Go deeper

PCNSE Secure Access and VPN Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question