PCNSE Decryption and SSL Inspection Practice Question
Which TWO of the following are supported decryption scenarios on a Palo Alto Networks firewall?
⚠ Common exam trap
Many exam-takers confuse 'SSL Termination' (a load-balancer concept) with 'SSL Inbound Inspection' (a firewall decryption feature), or mistakenly think 'Decryption Broker' is a Palo Alto Networks feature when it is actually a third-party architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL Forward Proxy
B is correct because SSL Forward Proxy allows the firewall to decrypt outbound traffic from internal clients to external servers by acting as an intermediary, generating a new certificate on the fly to inspect the session. E is correct because SSL Inbound Inspection enables the firewall to decrypt inbound traffic destined for protected servers, typically by importing the server's private key, allowing inspection of encrypted payloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Decryption Broker
Why it's wrong here
Decryption Broker is not a standard Palo Alto Networks feature.
- ✓
SSL Forward Proxy
Why this is correct
Correct: SSL Forward Proxy decrypts outbound traffic from internal clients to external servers.
- ✗
SSL Termination
Why it's wrong here
SSL Termination is not a separate decryption scenario; it is part of inbound inspection.
- ✗
SSH Proxy
Why it's wrong here
SSH Proxy is not a decryption scenario; it handles non-SSL traffic.
- ✓
SSL Inbound Inspection
Why this is correct
Correct: SSL Inbound Inspection decrypts inbound traffic to internal servers.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.