PCNSE Decryption and SSL Inspection Practice Question
A Palo Alto Networks firewall is configured for SSL Forward Proxy decryption. The security team wants to ensure that decrypted traffic is also inspected by an external DLP appliance. How should this be achieved?
⚠ Common exam trap
Test-takers frequently think re-encrypting traffic (Option C) is necessary for security, but the correct approach is to forward decrypted traffic in clear text to the DLP appliance, as re-encryption would require the DLP to decrypt again, defeating the purpose of the inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Decryption Policy to decrypt traffic and then use a Decryption Forwarding service to forward decrypted traffic to the DLP appliance.
The Palo Alto Networks firewall can be configured with a Decryption Forwarding service, which allows decrypted traffic to be forwarded to an external DLP appliance for additional inspection. This is achieved by defining a Decryption Forwarding profile that specifies the DLP appliance as the destination, ensuring that traffic decrypted by the SSL Forward Proxy is sent in clear text to the DLP appliance for content inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the DLP appliance to decrypt traffic itself.
Why it's wrong here
DLP appliances typically receive decrypted traffic from the firewall.
- ✓
Configure a Decryption Policy to decrypt traffic and then use a Decryption Forwarding service to forward decrypted traffic to the DLP appliance.
Why this is correct
This is the correct method using Decryption Forwarding feature.
- ✗
Configure the firewall to re-encrypt traffic before sending to DLP.
Why it's wrong here
DLP needs decrypted traffic for inspection.
- ✗
Add a decryption policy on the firewall to exclude traffic to the DLP appliance.
Why it's wrong here
That would bypass decryption for DLP traffic, not help.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.