PCNSE Securing Traffic and App-ID Practice Question
A security team is deploying SSL Decryption for inbound traffic to protect against threats hidden in encrypted traffic. However, they want to exclude financial transactions that use client certificates for authentication. What is the best approach?
⚠ Common exam trap
Many exam-takers confuse the 'Exclude Certificate' list (which excludes specific server certificates from decryption) with the need to exclude traffic based on client certificate authentication, leading them to incorrectly choose Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a decryption policy rule with 'No Decrypt' action for the financial application.
The security team needs to exclude specific traffic from SSL decryption without blocking it. A 'No Decrypt' action in a decryption policy rule allows the firewall to bypass decryption for matched traffic while still permitting it to pass through. This is the standard method for excluding sensitive traffic like financial transactions that use client certificates for authentication, as it avoids breaking mutual authentication or violating compliance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a decryption policy rule with a condition matching the client certificate.
Why it's wrong here
Decryption policies do not support matching on client certificates.
- ✗
Create a decryption policy rule that excludes the financial application based on URL category.
Why it's wrong here
URL categories are broader and may not precisely match the financial application. The application-based approach is more accurate.
- ✗
Use an SSL Forward Proxy decryption profile with 'Exclude Certificate' list.
Why it's wrong here
The 'Exclude Certificate' list is for server certificates, not client certificates.
- ✓
Use a decryption policy rule with 'No Decrypt' action for the financial application.
Why this is correct
Correct: This directly excludes traffic identified as the financial application from decryption.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.