PCNSE Core Concepts and Architecture Practice Question
Exhibit
set decryption rule decrypt-ssl from zone untrust to zone trust source any destination any application ssl action decrypt ssl-forward-proxy set decryption rule no-decrypt from zone untrust to zone trust source any destination any application ssl category finance,healthcare action no-decrypt
Refer to the exhibit. A user attempts to access a banking site (category: finance) over HTTPS. What will happen?
⚠ Common exam trap
Candidates often assume the first matching rule in a decryption policy is always applied, but Palo Alto Networks decryption policies allow a later 'No Decrypt' rule to override an earlier 'Decrypt' rule for the same traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is not decrypted because the second rule matches and overrides the first.
The firewall processes security rules from top to bottom, and the second rule explicitly matches HTTPS traffic to the finance category with an action of 'No Decrypt'. Since the second rule matches before any decryption rule, it overrides the first rule's decrypt action, and the traffic is not decrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is decrypted because the first rule matches.
Why it's wrong here
The first rule would match, but the second rule is more specific and overrides for finance category.
- ✗
The traffic is dropped because no rule matches.
Why it's wrong here
Both rules match, but the no-decrypt action applies.
- ✗
The traffic is decrypted only if the SSL certificate is installed.
Why it's wrong here
Certificate installation is required for decryption, but the rule set to no-decrypt prevents it.
- ✓
The traffic is not decrypted because the second rule matches and overrides the first.
Why this is correct
The no-decrypt rule for category finance matches, so decryption is bypassed.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.