PCNSE Decryption and SSL Inspection Practice Question
Which THREE statements are true regarding SSL Forward Proxy decryption on Palo Alto Networks firewalls?
⚠ Common exam trap
Many candidates assume SSL Forward Proxy decryption is limited to port 443, but Palo Alto firewalls can decrypt SSL/TLS on any TCP port by inspecting the handshake, and they also mistakenly think the decryption profile must contain a certificate for the firewall, when in fact the CA certificate is configured separately and the firewall generates session-specific certificates automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.
Palo Alto Networks decryption policy rules can match on a wide range of criteria including source zone, source user, destination IP, URL category, and service. This granularity allows administrators to selectively decrypt traffic based on business needs and security policies, not just basic IP/port matching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL Forward Proxy decryption can only be applied to traffic destined for TCP port 443.
Why it's wrong here
It can be applied to other ports as well, though 443 is default.
- ✓
Decryption policy rules can match on source zone, source user, destination IP, URL category, and service.
Why this is correct
These are common match criteria for decryption policy rules.
- ✓
The firewall must generate a certificate on-the-fly signed by a trusted CA for each decrypted session.
Why this is correct
This is correct; the firewall acts as a man-in-the-middle and creates a certificate signed by the enterprise CA.
- ✗
An 'ssl-decrypt' action in a decryption rule requires that the associated decryption profile includes a certificate for the firewall to use.
Why it's wrong here
The certificate is configured in the Decryption Profile, but the 'ssl-decrypt' action does not require it; the profile must have a certificate for forward proxy, but it's not the action that requires it.
- ✓
The firewall can inspect the Server Name Indication (SNI) field in the ClientHello to determine the destination hostname.
Why this is correct
SNI is used for policy matching when decryption is not possible or not required.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.