Match each decryption type to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Decrypts outbound traffic to inspect it
Decrypts inbound traffic to servers
Decrypts SSH traffic for policy enforcement
Traffic bypasses decryption
Sends decrypted traffic to a monitoring tool
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
SSL Forward Proxy: Decrypts outbound SSL/TLS traffic from internal clients to external servers.
Correct matches: SSL Forward Proxy decrypts outbound traffic; SSL Inbound Inspection decrypts inbound traffic; SSH Proxy inspects SSH; Decryption Mirror duplicates decrypted traffic. Common confusion is swapping the direction of SSL decryption types.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
SSL Forward Proxy: Decrypts outbound SSL/TLS traffic from internal clients to external servers.
Why this is correct
SSL Forward Proxy is used for inspecting outbound traffic.
SSL Inbound Inspection: Decrypts inbound SSL/TLS traffic destined for internal servers.
Why this is correct
SSL Inbound Inspection is for inbound traffic to protected servers.
SSH Proxy: Decrypts SSH traffic to inspect commands and prevent tunneling.
Why this is correct
SSH Proxy allows inspection of SSH sessions.
Decryption Mirror: Copies decrypted traffic to a security device for additional analysis.
Why this is correct
Decryption Mirror sends a copy of decrypted traffic to another device.
SSL Forward Proxy: Decrypts inbound SSL/TLS traffic destined for internal servers.
Why it's wrong here
Incorrect — this describes SSL Inbound Inspection, not SSL Forward Proxy.
SSL Inbound Inspection: Decrypts outbound SSL/TLS traffic from internal clients.
Why it's wrong here
Incorrect — this describes SSL Forward Proxy, not SSL Inbound Inspection.
Go deeper
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.