PCNSE Decryption and SSL Inspection Practice Question
An engineer is configuring SSL Forward Proxy decryption for internal users. The firewall must decrypt traffic to all external HTTPS sites except specific financial services domains that require end-to-end encryption. Which best practice should the engineer implement to achieve this?
⚠ Common exam trap
It's easy for candidates to confuse the 'Exclude Certificate' list in the Decryption Profile with a method to prevent decryption, when in fact it only affects certificate re-signing, not the decryption action itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.
It follows the best practice of using a 'no-decrypt' rule with higher priority than the 'ssl-decrypt' rule to exclude specific traffic from decryption. This ensures that traffic to financial services domains is not decrypted, while all other external HTTPS traffic is decrypted as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable decryption globally and create a custom URL category for the financial domains to enable decryption only for those.
Why it's wrong here
Disabling globally would prevent decryption of all traffic, including the financial domains if not correctly handled, and the approach is not typical.
- ✓
Create two Decryption Policy rules: one with 'ssl-decrypt' action for the general category and a second rule with 'no-decrypt' action for the financial domains.
Why this is correct
This allows decryption of most traffic while exempting the specified domains, following best practice.
- ✗
Upload the server certificates for the financial domains to the firewall and enable 'no-decrypt' on the Decryption Profile.
Why it's wrong here
Uploading server certificates is not required for no-decrypt; the decryption profile does not have a 'no-decrypt' setting per domain.
- ✗
Configure a single Decryption Policy rule with a 'decrypt' action and add the financial domains to the 'Exclude Certificate' list.
Why it's wrong here
'decrypt' is not a valid action; the correct action is 'ssl-decrypt'. Also, excluding certificates is not the intended method for skipping decryption.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.