PCNSE Troubleshoot Practice Question
An organization uses SSL Forward Proxy decryption for all web traffic. A user reports intermittent connectivity issues to a SaaS application. The firewall shows no drops or errors. Which of the following is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume intermittent issues must be caused by network problems like packet loss (Option C) or policy misconfigurations (Option B), but the key clue is 'no drops or errors' on the firewall, pointing to a higher-layer TLS negotiation mismatch that does not generate firewall-level drops.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.
In SSL Forward Proxy decryption, the firewall terminates the client's TLS connection and initiates a new TLS connection to the SaaS server. If the firewall and the SaaS server negotiate a TLS version that is incompatible for some connections—for example, the firewall supports TLS 1.2 but the server requires TLS 1.3, or vice versa—the handshake may fail intermittently, causing connectivity issues. Since the firewall shows no drops or errors, the problem is likely at the TLS negotiation layer rather than a network or policy issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall and the SaaS server negotiate a TLS version that is incompatible for some connections.
Why this is correct
SSL/TLS version mismatch can cause intermittent failures; the firewall may attempt a higher version than the server supports.
- ✗
The firewall's decryption policy is set to 'no-decrypt' for the application.
Why it's wrong here
If set to no-decrypt, all traffic for that application would bypass decryption, not be intermittent.
- ✗
The firewall's internet link experiences periodic packet loss.
Why it's wrong here
Packet loss would affect all traffic and be visible in session statistics or ping tests.
- ✗
The SaaS application's certificate is expired or revoked.
Why it's wrong here
An expired certificate would cause a consistent block, not intermittent connectivity.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.