PCNSE Securing Traffic and App-ID Practice Question
An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The URL category for banking is not correctly identified.
The decryption policy rules are evaluated top-down. The administrator placed the 'No Decrypt' rule first for banking URLs, which is the correct order. However, if the banking URLs do not match the URL category defined in the rule (e.g., the category is not correctly identified or updated), the 'No Decrypt' rule will not apply. Traffic then falls through to the second 'Decrypt' rule, which decrypts all remaining traffic, including banking. Therefore, the most likely issue is that the URL category for banking is not correctly identified (Option D).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSL Forward Proxy profile is set to ignore the decryption policy.
Why it's wrong here
This is not a standard configuration; the decryption policy always applies.
- ✗
The firewall is using a different decryption port than 443.
Why it's wrong here
If the traffic is on standard HTTPS port, this is not an issue.
- ✗
The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.
Why it's wrong here
The 'No Decrypt' rule should be first to exclude banking before the generic decrypt rule.
- ✓
The URL category for banking is not correctly identified.
Why this is correct
While possible, the more likely issue is rule ordering.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.