PCNSE SSL/TLS Decryption and Inspection 3

Question 1

What does the Decryption Broker feature do differently from Decryption Mirror in Palo Alto Networks?

Accepted Answer

Decryption Broker forwards decrypted traffic inline to third-party security tools while maintaining session state

Answer

Decryption Broker chains third-party security tools inline into the decrypted traffic path, whereas Decryption Mirror only sends a passive copy for out-of-band inspection.

Question 2

Which certificate validity check in a Decryption Profile verifies that a server certificate has not been revoked by its issuing CA?

Accepted Answer

CRL/OCSP Revocation Check

Answer

CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) checks confirm that a server's certificate has not been revoked since it was issued.

Question 3

When PAN-OS SSH Proxy decryption is configured, what specific SSH behavior is it designed to detect and control?

Accepted Answer

SSH tunneling and port forwarding used to bypass security controls

Answer

SSH Proxy targets SSH tunneling and port forwarding, which are commonly used to bypass firewall and security policies by encapsulating other protocols inside SSH.

Question 4

When a server uses ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) during the TLS handshake, how does a PAN-OS firewall performing SSL Forward Proxy handle key exchange?

Accepted Answer

The firewall negotiates independent ECDHE key pairs with both the client and the server

Answer

PAN-OS maintains two separate TLS sessions, negotiating its own ECDHE keys independently with the client and with the server, preserving Perfect Forward Secrecy while enabling inspection.

Question 5

Which piece of information from the TLS ClientHello message does PAN-OS use to match decryption policy rules BEFORE the SSL handshake completes?

Accepted Answer

Server Name Indication (SNI) field containing the destination hostname

Answer

The SNI extension in the TLS ClientHello is sent in plaintext before encryption begins, allowing the firewall to match decryption policy rules on the destination hostname early in the handshake.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE SSL/TLS Decryption and Inspection 3