PCNSE Decryption and SSL Inspection Practice Question
A network administrator is troubleshooting decryption failures for HTTPS traffic to a financial website. The firewall is configured with SSL Forward Proxy decryption policy that applies to the 'financial-services' URL category. The firewall uses an internal CA certificate to sign generated certificates. Users report a certificate error in their browsers when accessing 'https://www.bankofalice.com'. The error says the certificate is not trusted, even though the internal CA certificate is installed on all client devices. The administrator checks the firewall logs and sees no decryption errors; the session is being decrypted successfully. The administrator also confirms that the decryption policy is active and the firewall is not bypassing decryption. What is the most likely cause of the certificate error?
⚠ Common exam trap
It's easy for candidates to assume a certificate error means a CA trust issue or expired certificate, but the key clue is that the internal CA is installed and decryption succeeds—pointing to a pinning or key mismatch scenario that bypasses normal certificate validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The website uses Certificate Pinning which causes the browser to reject the firewall's certificate.
Certificate pinning (HTTP Public Key Pinning or HPKP) causes the browser to reject any certificate that does not match the pinned public key, even if the firewall's certificate is signed by a trusted internal CA. Since the firewall generates a new certificate on-the-fly with its own key pair, the browser detects the mismatch and displays a certificate error, despite successful decryption at the firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The website uses Certificate Pinning which causes the browser to reject the firewall's certificate.
Why this is correct
Certificate pinning causes the browser to expect a specific certificate hash; even a validly signed certificate from the firewall will be rejected.
- ✗
The firewall's decryption certificate does not have the correct subject name for the website.
Why it's wrong here
Forward proxy automatically generates certificates with the correct subject name from the original server's certificate.
- ✗
The firewall's decryption certificate is expired.
Why it's wrong here
No expiration errors are seen in logs, and the error is specifically about trust, not expiration.
- ✗
The decryption policy is configured to 'no-decrypt' for that traffic.
Why it's wrong here
If set to no-decrypt, traffic would pass through without decryption, and no certificate error would appear.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.