PCNSE Decryption and SSL Inspection Practice Question
An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?
⚠ Common exam trap
It's easy for candidates to confuse the 'Exclude Certificate' list in the Decryption Profile with a method to prevent decryption, when in fact it only affects certificate re-signing, not the decryption action itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.
It follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.
Why it's wrong here
Disabling decryption globally then enabling it per-URL is inverted: the requirement is decrypt-all-except-listed domains, so a no-decrypt rule for the financial category is needed. Global disable suits environments where decryption is the exception, not the default.
- ✓
Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.
Why this is correct
Ordering matters: the no-decrypt rule must sit above the ssl-decrypt rule, because PAN-OS evaluates decryption policy top-down and stops at the first match. This satisfies the stem's constraint that financial services domains retain end-to-end encryption while all other external HTTPS traffic is decrypted.
- ✗
Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.
Why it's wrong here
Uploading server certificates does not exclude destinations from decryption; exclusion requires a no-decrypt SSL Forward Proxy policy or decryption exclusion, not a Decryption Profile setting. Certificate uploads suit inbound SSL decryption or certificate pinning scenarios instead.
- ✗
Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.
Why it's wrong here
The 'Exclude Certificate' list bypasses decryption based on the server certificate's attributes, not the destination domain, so financial sites would still be decrypted unless their certificates match. It is tempting because certificate-based exclusion suits sites using client certificates or pinned certificates, where domain-based exclusion cannot work.
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.