PCNSE Manage, Monitor and Operate Practice Question

Exhibit

decryption profile:
  name: 'Decrypt-All'
  ssl-decryption:
    minimum-protocol-version: tls1-0
    maximum-protocol-version: tls1-2
    allow-block tls1-0
    block tls1-1
    allow tls1-2

Refer to the exhibit. Which SSL protocol version is blocked as per this decryption profile?

⚠ Common exam trap

Palo Alto Networks often tests the ability to read the exhibit carefully—candidates may assume that because TLS 1.1 is a deprecated protocol, the question is about which version is allowed, or they might confuse the 'Block' list with the 'Allow' list, leading them to pick TLS 1.0 or TLS 1.2 as the blocked version.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

TLS 1.1

The decryption profile in the exhibit shows 'TLS 1.1' explicitly selected under 'Block SSL/TLS Versions,' meaning any session attempting to negotiate TLS 1.1 will be blocked. This is a direct configuration setting in Palo Alto Networks firewalls where you can selectively block specific SSL/TLS protocol versions to enforce stronger cryptographic standards.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
TLS 1.1
Why this is correct
The profile explicitly blocks TLS 1.1.
✗
TLS 1.0
Why it's wrong here
TLS 1.0 is allowed with 'allow-block' (allowed but block list?)
✗
TLS 1.3
Why it's wrong here
TLS 1.3 is not mentioned in the profile.
✗
TLS 1.2
Why it's wrong here
TLS 1.2 is allowed.

Go deeper

PCNSE Manage, Monitor and Operate Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question