PCNSE Securing Traffic and App-ID Practice Question
Exhibit
Refer to the exhibit. admin@PA-1> show system info | match model model: PA-5250 admin@PA-1> show running decryption policy rule 1 name "No-Decrypt-Internal" source 192.168.0.0/16 destination 10.0.0.0/8 service https action no-decrypt rule 2 name "Decrypt-All" source any destination any service https action decrypt profile "default-forward-proxy" admin@PA-1> show running security policy rule 1 name "Allow-All" source any destination any application any service https action allow profile threat admin@PA-1> show threat log | match 10.0.0.5 <log entry: threat detected in SSL traffic>
A threat log entry shows a threat detected in SSL traffic to 10.0.0.5, which is a server in the internal network. However, the decryption policy has a rule to no-decrypt traffic to 10.0.0.0/8 from internal sources. What is the most likely reason the threat was detected?
⚠ Common exam trap
Many candidates assume 'No-Decrypt-Internal' applies to all traffic to internal IPs regardless of source, but the rule's source zone or IP must also be internal for it to match; external sources cause decryption to occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The threat was detected in decrypted traffic because the source was external.
The threat was detected because the decryption policy rule 'No-Decrypt-Internal' only applies to traffic where both the source and destination are internal (10.0.0.0/8). If the source is external, the traffic is decrypted by a higher-priority rule (e.g., 'Decrypt-All'), allowing the threat to be inspected and logged. The log entry shows the threat in SSL traffic to 10.0.0.5, but the source being external means the no-decrypt rule does not match, so decryption occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The decryption policy rule order is incorrect; the 'No-Decrypt-Internal' rule should be after the 'Decrypt-All' rule.
Why it's wrong here
The rules are in correct order; the no-decrypt rule is first to exclude internal traffic. Placing it after would cause internal traffic to be decrypted as well.
- ✓
The threat was detected in decrypted traffic because the source was external.
Why this is correct
Correct: The source is likely external, so the traffic is decrypted by rule 2, and the threat profile detected it.
- ✗
The threat log is misconfigured.
Why it's wrong here
There is no indication of misconfiguration; the log entry is valid.
- ✗
The security policy is blocking the traffic before decryption.
Why it's wrong here
The security policy allows all HTTPS traffic; blocking would prevent the threat log entry.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.