SSL/TLS Decryption and Inspection Flashcards

Which decryption mode does Palo Alto Networks use to inspect outbound user-initiated HTTPS traffic to the internet?

Answer: SSL Forward Proxy

SSL Forward Proxy is used for outbound traffic where the firewall acts as a man-in-the-middle, re-signing server certificates with its own CA certificate.

Which certificate must be distributed to client machines to prevent SSL warnings when SSL Forward Proxy decryption is enabled?

Answer: The firewall's Forward Trust CA certificate

The Forward Trust CA certificate must be installed as a trusted root CA on client devices so that firewall-re-signed certificates are trusted without browser warnings.

What is the purpose of the 'Forward Untrust' certificate in SSL Forward Proxy decryption?

Answer: To re-sign certificates from untrusted CAs so clients receive a warning

The Forward Untrust certificate re-signs server certificates that have untrusted, expired, or invalid CAs, intentionally triggering a browser warning to alert the user.

Which decryption type requires uploading the web server's private key to the firewall for inspecting inbound HTTPS traffic?

Answer: SSL Inbound Inspection

SSL Inbound Inspection uses the server's private key to decrypt inbound HTTPS sessions so the firewall can inspect traffic destined for internal servers.

In a decryption policy, which action explicitly exempts matched traffic from SSL/TLS inspection?

Answer: no-decrypt

The 'no-decrypt' action in a decryption policy rule prevents the matched traffic from being decrypted, passing it through without SSL inspection.

Which PAN-OS feature copies decrypted traffic to a dedicated interface for passive, out-of-band inspection by third-party security tools?

Answer: Decryption Mirror

Decryption Mirror sends a copy of decrypted SSL/TLS traffic to a separate interface for passive tools like DLP solutions or forensic analyzers to inspect.

What is the minimum cryptographic requirement for a certificate used in SSL Forward Proxy decryption on PAN-OS?

Answer: A CA certificate with a corresponding private key capable of signing other certificates

SSL Forward Proxy requires a CA certificate with its private key so the firewall can dynamically sign new certificates for each destination server it proxies.

Which PAN-OS object contains settings for minimum TLS version, cipher suite restrictions, and certificate verification behavior for decrypted traffic?

Answer: Decryption Profile

A Decryption Profile defines SSL/TLS protocol constraints, cipher requirements, and certificate check behaviors, and is referenced by decryption policy rules.

A mobile banking app stops working after SSL Forward Proxy decryption is enabled on the firewall. What is the most likely cause?

Answer: The app uses certificate pinning that rejects the firewall's re-signed certificate

Certificate pinning hard-codes a specific certificate fingerprint into the app; when the firewall re-signs with a different cert, the app rejects the connection.

How should an administrator configure decryption to honor employee privacy for traffic to financial services sites?

Answer: Create a no-decrypt rule targeting the 'financial-services' URL category

A no-decrypt decryption policy rule matching the 'financial-services' URL category explicitly excludes those sites from SSL inspection to protect user privacy.

What does the 'Unsupported Mode Check' setting in a Decryption Profile control?

Answer: It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt

The Unsupported Mode Check setting decides the action (allow or block) for SSL/TLS traffic that cannot be decrypted due to unsupported protocols, modes, or ciphers.

In what order does PAN-OS evaluate decryption policies?

Answer: Top-down, with the first matching rule applied

Like security policies, decryption policies are evaluated from top to bottom and the first rule that matches the traffic criteria is applied.

Which CLI command on PAN-OS can an administrator use to confirm whether a specific active session is being SSL decrypted?

Answer: show session id

'show session id ' displays detailed session attributes including a 'decrypt' field indicating whether SSL/TLS decryption is active for that session.

What is the function of an SSL/TLS Service Profile in PAN-OS, as distinct from a Decryption Profile?

Answer: It configures TLS protocol settings for the firewall's own management services

SSL/TLS Service Profiles configure TLS protocol versions and cipher suites for PAN-OS management plane services such as the web UI, GlobalProtect, and Captive Portal.

What does the Decryption Broker feature do differently from Decryption Mirror in Palo Alto Networks?

Answer: Decryption Broker forwards decrypted traffic inline to third-party security tools while maintaining session state

Decryption Broker chains third-party security tools inline into the decrypted traffic path, whereas Decryption Mirror only sends a passive copy for out-of-band inspection.

Which certificate validity check in a Decryption Profile verifies that a server certificate has not been revoked by its issuing CA?

Answer: CRL/OCSP Revocation Check

CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) checks confirm that a server's certificate has not been revoked since it was issued.

When PAN-OS SSH Proxy decryption is configured, what specific SSH behavior is it designed to detect and control?

Answer: SSH tunneling and port forwarding used to bypass security controls

SSH Proxy targets SSH tunneling and port forwarding, which are commonly used to bypass firewall and security policies by encapsulating other protocols inside SSH.

When a server uses ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) during the TLS handshake, how does a PAN-OS firewall performing SSL Forward Proxy handle key exchange?

Answer: The firewall negotiates independent ECDHE key pairs with both the client and the server

PAN-OS maintains two separate TLS sessions, negotiating its own ECDHE keys independently with the client and with the server, preserving Perfect Forward Secrecy while enabling inspection.

Which piece of information from the TLS ClientHello message does PAN-OS use to match decryption policy rules BEFORE the SSL handshake completes?

Answer: Server Name Indication (SNI) field containing the destination hostname

The SNI extension in the TLS ClientHello is sent in plaintext before encryption begins, allowing the firewall to match decryption policy rules on the destination hostname early in the handshake.

Which PAN-OS feature automatically builds a list of sites that should be excluded from SSL decryption based on observed SSL errors and handshake failures?

Answer: SSL Exclude Cache (Decryption Exclusion Cache)

The SSL Exclude Cache automatically adds sites causing SSL errors during decryption (such as certificate-pinned apps) to a dynamic exclusion list to prevent recurring connectivity failures.