PCNSE Decryption and SSL Inspection Practice Question

Exhibit

Refer to the exhibit.
```
Decryption Policy Rule 1:
  Name: Decrypt_HR_Traffic
  Source: 10.0.1.0/24
  Destination: any
  Service: any
  URL Category: Human-Resources
  Action: decrypt

Decryption Policy Rule 2:
  Name: Decrypt_All
  Source: any
  Destination: any
  Service: any
  URL Category: any
  Action: decrypt

Decryption Policy Rule 3:
  Name: No_Decrypt_Finance
  Source: any
  Destination: any
  Service: any
  URL Category: Finance
  Action: no-decrypt

Ordering: Rule 1, Rule 2, Rule 3
```

A user from subnet 10.0.1.0/24 accesses a website categorized as 'Finance'. Based on the exhibit, what will be the result?

⚠ Common exam trap

Palo Alto Networks often tests the rule evaluation order in decryption policies, where candidates mistakenly think a later rule (like Rule 3) overrides an earlier matching rule (Rule 2) due to a more specific category or action, but in reality, the first match wins regardless of specificity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The traffic will be decrypted by Rule 2.

Rule 2 matches traffic from subnet 10.0.1.0/24 to the 'Finance' category and has an action of 'decrypt'. The exhibit shows Rule 2 with source 10.0.1.0/24, destination category 'Finance', and action 'decrypt'. Since the user's traffic matches all criteria in Rule 2, it will be decrypted. Rule 3 is not evaluated because Rule 2 matches first and has a higher priority (lower rule number).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The traffic will not be decrypted because Rule 3 matches.
Why it's wrong here
Rule 3 is after Rule 2, so Rule 2 applies first.
✓
The traffic will be decrypted by Rule 2.
Why this is correct
Rule 2 is a catch-all that will match and decrypt.
✗
The traffic will be blocked because no matching rule exists.
Why it's wrong here
A decryption policy does not block; it only decides to decrypt or not.
✗
The traffic will be decrypted by Rule 1.
Why it's wrong here
Rule 1 only matches HR category, not Finance.

Visual reference

Go deeper

PCNSE Decryption and SSL Inspection Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question