PCNSE Decryption and SSL Inspection Practice Question
A user reports that after SSL decryption was enabled, certain web applications fail to load completely. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to confuse certificate pinning with general certificate validation or assume that any decryption policy misconfiguration (like URL filtering) is the cause, rather than recognizing the specific application-level security mechanism that explicitly rejects the firewall's decryption certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application uses certificate pinning which rejects the firewall's decryption certificate.
Certificate pinning is a security mechanism where an application embeds the exact certificate or public key of the server it expects to communicate with. When SSL decryption is enabled, the firewall replaces the original server certificate with its own decryption certificate. The application detects this mismatch and rejects the connection, causing it to fail to load completely. This is a common issue with applications that implement strict certificate pinning, such as banking apps or certain mobile applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The URL is not allowed in the decryption policy.
Why it's wrong here
That would block the site, not cause partial loading.
- ✗
The user's browser proxy settings are incorrect.
Why it's wrong here
Decryption in forward proxy does not require manual proxy configuration.
- ✓
The application uses certificate pinning which rejects the firewall's decryption certificate.
Why this is correct
Certificate pinning is a common cause of failure with SSL decryption.
- ✗
The firewall's decryption is causing excessive latency.
Why it's wrong here
Latency would cause slowness, not complete failure.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.