PCNSE Decryption and SSL Inspection Practice Question
A security administrator has configured SSL decryption on a Palo Alto Networks firewall. After decryption, some users report that they cannot access a specific banking website, and the firewall logs show the session as 'decryption excluded' for that site. The administrator wants to ensure that the firewall does not decrypt traffic to this banking site while still decrypting all other HTTPS traffic. What should the administrator configure to achieve this?
⚠ Common exam trap
Candidates often confuse decryption profiles with decryption policy actions; profiles control how to handle decrypted traffic, while policy rules determine whether to decrypt or not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a decryption policy rule with the action 'no-decrypt' and match the banking site's URL category or FQDN.
To exclude specific traffic from SSL decryption, a decryption policy rule with the action 'no-decrypt' must be created and placed above the decryption rule. This rule can match on various criteria such as URL category, FQDN, or source/destination. This ensures that the banking site's traffic bypasses decryption while other HTTPS traffic continues to be decrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the banking site's certificate to the firewall's trusted certificate list and set the decryption policy to 'decrypt'.
Why it's wrong here
Adding the site's certificate to the trusted list would allow the firewall to validate the certificate during decryption, but it does not prevent decryption. The goal is to exclude the site from decryption entirely, which requires a no-decrypt rule. Trusting the certificate does not change the decryption action.
- ✓
Create a decryption policy rule with the action 'no-decrypt' and match the banking site's URL category or FQDN.
Why this is correct
A decryption policy rule with action 'no-decrypt' allows specific traffic to bypass decryption based on criteria such as URL category, source, destination, or service. Placing this rule above the decryption rule ensures that traffic to the banking site is excluded from decryption while other HTTPS traffic is still decrypted. This is the correct method to selectively bypass decryption.
- ✗
Configure a decryption profile with 'Block Untrusted Issuers' enabled and apply it to the decryption policy rule.
Why it's wrong here
Enabling 'Block Untrusted Issuers' in a decryption profile would cause the firewall to block connections to sites with untrusted certificates, but it does not selectively bypass decryption for specific sites. It would apply to all traffic matched by the rule and could block the banking site if its certificate is untrusted, but it does not exclude it from decryption.
- ✗
Modify the existing decryption policy rule to exclude the banking site by adding its IP address to the source field.
Why it's wrong here
Adding the banking site's IP address to the source field would not work because the source field typically refers to the client's IP address, not the server's. The banking site's IP would be a destination. Also, IP addresses can change, making this unreliable. The correct approach is to use a no-decrypt rule with appropriate matching criteria.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.