PCNSE SSL/TLS Decryption and Inspection — Questions and Answers

Question 1: Which decryption mode does Palo Alto Networks use to inspect outbound user-initiated HTTPS traffic to the internet?

SSL Forward Proxy (Correct answer)
SSL Inbound Inspection
SSH Proxy
TLS Offloading

Correct answer: SSL Forward Proxy

SSL Forward Proxy is used for outbound traffic where the firewall acts as a man-in-the-middle, re-signing server certificates with its own CA certificate.

Question 2: Which certificate must be distributed to client machines to prevent SSL warnings when SSL Forward Proxy decryption is enabled?

The web server's public certificate
The firewall's Forward Trust CA certificate (Correct answer)
The Forward Untrust certificate
The Palo Alto root CA certificate

Correct answer: The firewall's Forward Trust CA certificate

The Forward Trust CA certificate must be installed as a trusted root CA on client devices so that firewall-re-signed certificates are trusted without browser warnings.

Question 3: What is the purpose of the 'Forward Untrust' certificate in SSL Forward Proxy decryption?

To trust all self-signed server certificates automatically
To re-sign certificates from untrusted CAs so clients receive a warning (Correct answer)
To block all connections to servers with invalid certificates
To bypass decryption for sites on the exclusion list

Correct answer: To re-sign certificates from untrusted CAs so clients receive a warning

The Forward Untrust certificate re-signs server certificates that have untrusted, expired, or invalid CAs, intentionally triggering a browser warning to alert the user.

Question 4: Which decryption type requires uploading the web server's private key to the firewall for inspecting inbound HTTPS traffic?

SSL Forward Proxy
SSH Proxy
SSL Inbound Inspection (Correct answer)
Decryption Broker

Correct answer: SSL Inbound Inspection

SSL Inbound Inspection uses the server's private key to decrypt inbound HTTPS sessions so the firewall can inspect traffic destined for internal servers.

Question 5: In a decryption policy, which action explicitly exempts matched traffic from SSL/TLS inspection?

allow
deny
no-decrypt (Correct answer)
bypass

Correct answer: no-decrypt

The 'no-decrypt' action in a decryption policy rule prevents the matched traffic from being decrypted, passing it through without SSL inspection.

Question 6: Which PAN-OS feature copies decrypted traffic to a dedicated interface for passive, out-of-band inspection by third-party security tools?

Decryption Broker
Decryption Mirror (Correct answer)
SSL Inbound Inspection
Tap Mode

Correct answer: Decryption Mirror

Decryption Mirror sends a copy of decrypted SSL/TLS traffic to a separate interface for passive tools like DLP solutions or forensic analyzers to inspect.

Question 7: What is the minimum cryptographic requirement for a certificate used in SSL Forward Proxy decryption on PAN-OS?

A wildcard SSL/TLS server certificate
A CA certificate with a corresponding private key capable of signing other certificates (Correct answer)
The private keys of all destination web servers
A decryption license from Palo Alto Networks

Correct answer: A CA certificate with a corresponding private key capable of signing other certificates

SSL Forward Proxy requires a CA certificate with its private key so the firewall can dynamically sign new certificates for each destination server it proxies.

Question 8: Which PAN-OS object contains settings for minimum TLS version, cipher suite restrictions, and certificate verification behavior for decrypted traffic?

Security Profile
Decryption Policy rule
Decryption Profile (Correct answer)
SSL/TLS Service Profile

Correct answer: Decryption Profile

A Decryption Profile defines SSL/TLS protocol constraints, cipher requirements, and certificate check behaviors, and is referenced by decryption policy rules.

Question 9: A mobile banking app stops working after SSL Forward Proxy decryption is enabled on the firewall. What is the most likely cause?

The bank's server blocks all proxy-sourced connections
The forward trust CA certificate was not imported correctly
The app uses certificate pinning that rejects the firewall's re-signed certificate (Correct answer)
The decryption policy is missing the correct URL category

Correct answer: The app uses certificate pinning that rejects the firewall's re-signed certificate

Certificate pinning hard-codes a specific certificate fingerprint into the app; when the firewall re-signs with a different cert, the app rejects the connection.

Question 10: How should an administrator configure decryption to honor employee privacy for traffic to financial services sites?

Apply SSL Forward Proxy decryption to all HTTPS traffic
Create a no-decrypt rule targeting the 'financial-services' URL category (Correct answer)
Block HTTPS traffic to financial institutions entirely
Use SSL Inbound Inspection for financial sites instead

Correct answer: Create a no-decrypt rule targeting the 'financial-services' URL category

A no-decrypt decryption policy rule matching the 'financial-services' URL category explicitly excludes those sites from SSL inspection to protect user privacy.

Question 11: What does the 'Unsupported Mode Check' setting in a Decryption Profile control?

It upgrades legacy TLS sessions to the minimum allowed version automatically
It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt (Correct answer)
It logs sessions using deprecated cipher suites without taking action
It routes undecryptable traffic to an alternate security zone

Correct answer: It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt

The Unsupported Mode Check setting decides the action (allow or block) for SSL/TLS traffic that cannot be decrypted due to unsupported protocols, modes, or ciphers.

Question 12: In what order does PAN-OS evaluate decryption policies?

Alphabetically by rule name
Top-down, with the first matching rule applied (Correct answer)
By specificity, most specific rule first regardless of position
Bottom-up, with the last matching rule applied

Correct answer: Top-down, with the first matching rule applied

Like security policies, decryption policies are evaluated from top to bottom and the first rule that matches the traffic criteria is applied.

Question 13: Which CLI command on PAN-OS can an administrator use to confirm whether a specific active session is being SSL decrypted?

show running decryption sessions
show session id <session-id> (Correct answer)
debug ssl decrypt list
show decryption status all

Correct answer: show session id <session-id>

'show session id <session-id>' displays detailed session attributes including a 'decrypt' field indicating whether SSL/TLS decryption is active for that session.

Question 14: What is the function of an SSL/TLS Service Profile in PAN-OS, as distinct from a Decryption Profile?

It defines decryption rules for user traffic
It configures TLS protocol settings for the firewall's own management services (Correct answer)
It stores CA certificates used for SSL Forward Proxy
It monitors SSL decryption throughput and performance

Correct answer: It configures TLS protocol settings for the firewall's own management services

SSL/TLS Service Profiles configure TLS protocol versions and cipher suites for PAN-OS management plane services such as the web UI, GlobalProtect, and Captive Portal.

Question 15: What does the Decryption Broker feature do differently from Decryption Mirror in Palo Alto Networks?

Decryption Broker sends copies of decrypted traffic passively, Mirror sends it inline
Decryption Broker forwards decrypted traffic inline to third-party security tools while maintaining session state (Correct answer)
Decryption Broker offloads SSL processing to a dedicated hardware appliance
Decryption Broker manages certificate distribution to client endpoints

Correct answer: Decryption Broker forwards decrypted traffic inline to third-party security tools while maintaining session state

Decryption Broker chains third-party security tools inline into the decrypted traffic path, whereas Decryption Mirror only sends a passive copy for out-of-band inspection.

Question 16: Which certificate validity check in a Decryption Profile verifies that a server certificate has not been revoked by its issuing CA?

Certificate Expiry Check
CRL/OCSP Revocation Check (Correct answer)
Certificate Authority Trust Check
Subject Alternative Name Check

Correct answer: CRL/OCSP Revocation Check

CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) checks confirm that a server's certificate has not been revoked since it was issued.

Question 17: When PAN-OS SSH Proxy decryption is configured, what specific SSH behavior is it designed to detect and control?

Interactive terminal sessions using password authentication
SSH tunneling and port forwarding used to bypass security controls (Correct answer)
Secure file transfers using SFTP
SSH key-based authentication attempts

Correct answer: SSH tunneling and port forwarding used to bypass security controls

SSH Proxy targets SSH tunneling and port forwarding, which are commonly used to bypass firewall and security policies by encapsulating other protocols inside SSH.

Question 18: When a server uses ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) during the TLS handshake, how does a PAN-OS firewall performing SSL Forward Proxy handle key exchange?

The session is automatically blocked because ECDHE cannot be proxied
The firewall negotiates independent ECDHE key pairs with both the client and the server (Correct answer)
The session falls back to RSA key exchange to enable decryption
ECDHE traffic is passed through without decryption

Correct answer: The firewall negotiates independent ECDHE key pairs with both the client and the server

PAN-OS maintains two separate TLS sessions, negotiating its own ECDHE keys independently with the client and with the server, preserving Perfect Forward Secrecy while enabling inspection.

Question 19: Which piece of information from the TLS ClientHello message does PAN-OS use to match decryption policy rules BEFORE the SSL handshake completes?

Application identification from App-ID signatures
Server Name Indication (SNI) field containing the destination hostname (Correct answer)
The server's certificate Common Name (CN)
The full URL path of the requested resource

Correct answer: Server Name Indication (SNI) field containing the destination hostname

The SNI extension in the TLS ClientHello is sent in plaintext before encryption begins, allowing the firewall to match decryption policy rules on the destination hostname early in the handshake.

Question 20: Which PAN-OS feature automatically builds a list of sites that should be excluded from SSL decryption based on observed SSL errors and handshake failures?

Decryption Profile exceptions list
URL Filtering automatic exclusion
SSL Exclude Cache (Decryption Exclusion Cache) (Correct answer)
Dynamic Address Group for SSL exclusions

Correct answer: SSL Exclude Cache (Decryption Exclusion Cache)

The SSL Exclude Cache automatically adds sites causing SSL errors during decryption (such as certificate-pinned apps) to a dynamic exclusion list to prevent recurring connectivity failures.

Question 21: An administrator wants to apply SSL Forward Proxy only to risky URL categories while excluding cloud storage and health-related sites. What is the recommended approach?

Configure a single decryption rule that matches all HTTPS traffic
Create a no-decrypt rule above the decrypt rule targeting the excluded URL categories (Correct answer)
Use an application override policy to skip decryption
Disable decryption for specific IP subnets in the security policy

Correct answer: Create a no-decrypt rule above the decrypt rule targeting the excluded URL categories

Placing a no-decrypt rule above the decrypt rule for the excluded URL categories ensures those sites are matched first and bypass SSL inspection while all other HTTPS traffic is decrypted.

PCNSE SSL/TLS Decryption and Inspection

Which decryption mode does Palo Alto Networks use to inspect outbound user-initiated HTTPS traffic to the internet?

🃏 PCNSE Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full PCNSE Study Guide →

What Practice Test Geeks adds beyond an AI chat for PCNSE

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length PCNSE mock exam — 75 questions in 90 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed PCNSE question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable PCNSE cheat sheet you can print or save as a PDF.
PCNSE flashcards built from the same question bank.

Start the Timed PCNSE Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

paloaltonetworks.com — Retake fee, score release, passing score, renewal, exam information · verified Nov 2026
pearsonvue.com — Test delivery · verified Oct 2026
live.paloaltonetworks.com — Score validity · verified Oct 2026