PCNSE SSL/TLS Decryption and Inspection 2

Question 1

Which PAN-OS object contains settings for minimum TLS version, cipher suite restrictions, and certificate verification behavior for decrypted traffic?

Accepted Answer

Decryption Profile

Answer

A Decryption Profile defines SSL/TLS protocol constraints, cipher requirements, and certificate check behaviors, and is referenced by decryption policy rules.

Question 2

A mobile banking app stops working after SSL Forward Proxy decryption is enabled on the firewall. What is the most likely cause?

Accepted Answer

The app uses certificate pinning that rejects the firewall's re-signed certificate

Answer

Certificate pinning hard-codes a specific certificate fingerprint into the app; when the firewall re-signs with a different cert, the app rejects the connection.

Question 3

How should an administrator configure decryption to honor employee privacy for traffic to financial services sites?

Accepted Answer

Create a no-decrypt rule targeting the 'financial-services' URL category

Answer

A no-decrypt decryption policy rule matching the 'financial-services' URL category explicitly excludes those sites from SSL inspection to protect user privacy.

Question 4

What does the 'Unsupported Mode Check' setting in a Decryption Profile control?

Accepted Answer

It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt

Answer

The Unsupported Mode Check setting decides the action (allow or block) for SSL/TLS traffic that cannot be decrypted due to unsupported protocols, modes, or ciphers.

Question 5

In what order does PAN-OS evaluate decryption policies?

Accepted Answer

Top-down, with the first matching rule applied

Answer

Like security policies, decryption policies are evaluated from top to bottom and the first rule that matches the traffic criteria is applied.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE SSL/TLS Decryption and Inspection 2