PCNSE SSL/TLS Decryption and Inspection 2

Question 1

Which PAN-OS object contains settings for minimum TLS version, cipher suite restrictions, and certificate verification behavior for decrypted traffic?

Accepted Answer

Decryption Profile

Answer

Security Profile

Answer

Decryption Policy rule

Answer

SSL/TLS Service Profile

Question 2

A mobile banking app stops working after SSL Forward Proxy decryption is enabled on the firewall. What is the most likely cause?

Accepted Answer

The app uses certificate pinning that rejects the firewall's re-signed certificate

Answer

The bank's server blocks all proxy-sourced connections

Answer

The forward trust CA certificate was not imported correctly

Answer

The decryption policy is missing the correct URL category

Question 3

How should an administrator configure decryption to honor employee privacy for traffic to financial services sites?

Accepted Answer

Create a no-decrypt rule targeting the 'financial-services' URL category

Answer

Apply SSL Forward Proxy decryption to all HTTPS traffic

Answer

Block HTTPS traffic to financial institutions entirely

Answer

Use SSL Inbound Inspection for financial sites instead

Question 4

What does the 'Unsupported Mode Check' setting in a Decryption Profile control?

Accepted Answer

It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt

Answer

It upgrades legacy TLS sessions to the minimum allowed version automatically

Answer

It logs sessions using deprecated cipher suites without taking action

Answer

It routes undecryptable traffic to an alternate security zone

Question 5

In what order does PAN-OS evaluate decryption policies?

Accepted Answer

Top-down, with the first matching rule applied

Answer

Alphabetically by rule name

Answer

By specificity, most specific rule first regardless of position

Answer

Bottom-up, with the last matching rule applied

Question 6

Which CLI command on PAN-OS can an administrator use to confirm whether a specific active session is being SSL decrypted?

Accepted Answer

show session id <session-id>

Answer

show running decryption sessions

Answer

debug ssl decrypt list

Answer

show decryption status all

Question 7

What is the function of an SSL/TLS Service Profile in PAN-OS, as distinct from a Decryption Profile?

Accepted Answer

It configures TLS protocol settings for the firewall's own management services

Answer

It defines decryption rules for user traffic

Answer

It stores CA certificates used for SSL Forward Proxy

Answer

It monitors SSL decryption throughput and performance