PCNSE Decryption and SSL Inspection Practice Question
Which THREE steps should be taken to troubleshoot an SSL decryption issue where users are unable to access specific HTTPS websites? (Choose three.)
⚠ Common exam trap
Many candidates confuse decryption failures with URL filtering or policy issues, leading them to select option B, when in fact decryption logs and certificate trust are the direct troubleshooting steps for SSL decryption problems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.
The decryption log provides direct visibility into SSL/TLS handshake failures. Errors like 'ssl_decrypt_unsupported_cipher' indicate the firewall cannot negotiate a cipher it supports, while 'ssl_decrypt_cert_verify_failed' points to certificate validation issues, such as an untrusted or expired server certificate. These logs are the primary diagnostic tool for pinpointing why decryption fails for specific HTTPS sites.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the decryption log for errors such as 'ssl_decrypt_unsupported_cipher' or 'ssl_decrypt_cert_verify_failed'.
Why this is correct
Logs provide specific error hints.
- ✗
Update the URL filtering database to ensure the site is categorized correctly.
Why it's wrong here
Does not affect decryption; that affects policy matching.
- ✓
Verify that the firewall's decryption certificate is trusted by the client.
Why this is correct
Untrusted certificates cause browser warnings.
- ✗
Disable decryption globally to see if the sites become accessible.
Why it's wrong here
This is a disruptive workaround, not a troubleshooting step.
- ✓
Use the packet capture tool to analyze the SSL handshake between client, firewall, and server.
Why this is correct
Packet capture reveals handshake failures.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.