PCNSE SSL/TLS Decryption and Inspection 1 — Questions and Answers
Question 1: Which decryption mode does Palo Alto Networks use to inspect outbound user-initiated HTTPS traffic to the internet?
- SSL Forward Proxy (Correct answer)
- SSL Inbound Inspection
- SSH Proxy
- TLS Offloading
Correct answer: SSL Forward Proxy
SSL Forward Proxy is used for outbound traffic where the firewall acts as a man-in-the-middle, re-signing server certificates with its own CA certificate.
Question 2: Which certificate must be distributed to client machines to prevent SSL warnings when SSL Forward Proxy decryption is enabled?
- The web server's public certificate
- The firewall's Forward Trust CA certificate (Correct answer)
- The Forward Untrust certificate
- The Palo Alto root CA certificate
Correct answer: The firewall's Forward Trust CA certificate
The Forward Trust CA certificate must be installed as a trusted root CA on client devices so that firewall-re-signed certificates are trusted without browser warnings.
Question 3: What is the purpose of the 'Forward Untrust' certificate in SSL Forward Proxy decryption?
- To trust all self-signed server certificates automatically
- To re-sign certificates from untrusted CAs so clients receive a warning (Correct answer)
- To block all connections to servers with invalid certificates
- To bypass decryption for sites on the exclusion list
Correct answer: To re-sign certificates from untrusted CAs so clients receive a warning
The Forward Untrust certificate re-signs server certificates that have untrusted, expired, or invalid CAs, intentionally triggering a browser warning to alert the user.
Question 4: Which decryption type requires uploading the web server's private key to the firewall for inspecting inbound HTTPS traffic?
- SSL Forward Proxy
- SSH Proxy
- SSL Inbound Inspection (Correct answer)
- Decryption Broker
Correct answer: SSL Inbound Inspection
SSL Inbound Inspection uses the server's private key to decrypt inbound HTTPS sessions so the firewall can inspect traffic destined for internal servers.
Question 5: In a decryption policy, which action explicitly exempts matched traffic from SSL/TLS inspection?
- allow
- deny
- no-decrypt (Correct answer)
- bypass
Correct answer: no-decrypt
The 'no-decrypt' action in a decryption policy rule prevents the matched traffic from being decrypted, passing it through without SSL inspection.
Question 6: Which PAN-OS feature copies decrypted traffic to a dedicated interface for passive, out-of-band inspection by third-party security tools?
- Decryption Broker
- Decryption Mirror (Correct answer)
- SSL Inbound Inspection
- Tap Mode
Correct answer: Decryption Mirror
Decryption Mirror sends a copy of decrypted SSL/TLS traffic to a separate interface for passive tools like DLP solutions or forensic analyzers to inspect.
Question 7: What is the minimum cryptographic requirement for a certificate used in SSL Forward Proxy decryption on PAN-OS?
- A wildcard SSL/TLS server certificate
- A CA certificate with a corresponding private key capable of signing other certificates (Correct answer)
- The private keys of all destination web servers
- A decryption license from Palo Alto Networks
Correct answer: A CA certificate with a corresponding private key capable of signing other certificates
SSL Forward Proxy requires a CA certificate with its private key so the firewall can dynamically sign new certificates for each destination server it proxies.
PCNSE SSL/TLS Decryption and Inspection 1
Which decryption mode does Palo Alto Networks use to inspect outbound user-initiated HTTPS traffic to the internet?