PCNSE SSL/TLS Decryption and Inspection 3

Question 1

What does the Decryption Broker feature do differently from Decryption Mirror in Palo Alto Networks?

Accepted Answer

Decryption Broker forwards decrypted traffic inline to third-party security tools while maintaining session state

Answer

Decryption Broker sends copies of decrypted traffic passively, Mirror sends it inline

Answer

Decryption Broker offloads SSL processing to a dedicated hardware appliance

Answer

Decryption Broker manages certificate distribution to client endpoints

Question 2

Which certificate validity check in a Decryption Profile verifies that a server certificate has not been revoked by its issuing CA?

Accepted Answer

CRL/OCSP Revocation Check

Answer

Certificate Expiry Check

Answer

Certificate Authority Trust Check

Answer

Subject Alternative Name Check

Question 3

When PAN-OS SSH Proxy decryption is configured, what specific SSH behavior is it designed to detect and control?

Accepted Answer

SSH tunneling and port forwarding used to bypass security controls

Answer

Interactive terminal sessions using password authentication

Answer

Secure file transfers using SFTP

Answer

SSH key-based authentication attempts

Question 4

When a server uses ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) during the TLS handshake, how does a PAN-OS firewall performing SSL Forward Proxy handle key exchange?

Accepted Answer

The firewall negotiates independent ECDHE key pairs with both the client and the server

Answer

The session is automatically blocked because ECDHE cannot be proxied

Answer

The session falls back to RSA key exchange to enable decryption

Answer

ECDHE traffic is passed through without decryption

Question 5

Which piece of information from the TLS ClientHello message does PAN-OS use to match decryption policy rules BEFORE the SSL handshake completes?

Accepted Answer

Server Name Indication (SNI) field containing the destination hostname

Answer

Application identification from App-ID signatures

Answer

The server's certificate Common Name (CN)

Answer

The full URL path of the requested resource

Question 6

Which PAN-OS feature automatically builds a list of sites that should be excluded from SSL decryption based on observed SSL errors and handshake failures?

Accepted Answer

SSL Exclude Cache (Decryption Exclusion Cache)

Answer

Decryption Profile exceptions list

Answer

URL Filtering automatic exclusion

Answer

Dynamic Address Group for SSL exclusions

Question 7

An administrator wants to apply SSL Forward Proxy only to risky URL categories while excluding cloud storage and health-related sites. What is the recommended approach?

Accepted Answer

Create a no-decrypt rule above the decrypt rule targeting the excluded URL categories

Answer

Configure a single decryption rule that matches all HTTPS traffic

Answer

Use an application override policy to skip decryption

Answer

Disable decryption for specific IP subnets in the security policy