PCNSE SSL/TLS Decryption and Inspection 2 — Questions and Answers
Question 1: Which PAN-OS object contains settings for minimum TLS version, cipher suite restrictions, and certificate verification behavior for decrypted traffic?
- Security Profile
- Decryption Policy rule
- Decryption Profile (Correct answer)
- SSL/TLS Service Profile
Correct answer: Decryption Profile
A Decryption Profile defines SSL/TLS protocol constraints, cipher requirements, and certificate check behaviors, and is referenced by decryption policy rules.
Question 2: A mobile banking app stops working after SSL Forward Proxy decryption is enabled on the firewall. What is the most likely cause?
- The bank's server blocks all proxy-sourced connections
- The forward trust CA certificate was not imported correctly
- The app uses certificate pinning that rejects the firewall's re-signed certificate (Correct answer)
- The decryption policy is missing the correct URL category
Correct answer: The app uses certificate pinning that rejects the firewall's re-signed certificate
Certificate pinning hard-codes a specific certificate fingerprint into the app; when the firewall re-signs with a different cert, the app rejects the connection.
Question 3: How should an administrator configure decryption to honor employee privacy for traffic to financial services sites?
- Apply SSL Forward Proxy decryption to all HTTPS traffic
- Create a no-decrypt rule targeting the 'financial-services' URL category (Correct answer)
- Block HTTPS traffic to financial institutions entirely
- Use SSL Inbound Inspection for financial sites instead
Correct answer: Create a no-decrypt rule targeting the 'financial-services' URL category
A no-decrypt decryption policy rule matching the 'financial-services' URL category explicitly excludes those sites from SSL inspection to protect user privacy.
Question 4: What does the 'Unsupported Mode Check' setting in a Decryption Profile control?
- It upgrades legacy TLS sessions to the minimum allowed version automatically
- It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt (Correct answer)
- It logs sessions using deprecated cipher suites without taking action
- It routes undecryptable traffic to an alternate security zone
Correct answer: It determines whether to block or allow SSL/TLS sessions that the firewall cannot decrypt
The Unsupported Mode Check setting decides the action (allow or block) for SSL/TLS traffic that cannot be decrypted due to unsupported protocols, modes, or ciphers.
Question 5: In what order does PAN-OS evaluate decryption policies?
- Alphabetically by rule name
- Top-down, with the first matching rule applied (Correct answer)
- By specificity, most specific rule first regardless of position
- Bottom-up, with the last matching rule applied
Correct answer: Top-down, with the first matching rule applied
Like security policies, decryption policies are evaluated from top to bottom and the first rule that matches the traffic criteria is applied.
Question 6: Which CLI command on PAN-OS can an administrator use to confirm whether a specific active session is being SSL decrypted?
- show running decryption sessions
- show session id <session-id> (Correct answer)
- debug ssl decrypt list
- show decryption status all
Correct answer: show session id <session-id>
'show session id <session-id>' displays detailed session attributes including a 'decrypt' field indicating whether SSL/TLS decryption is active for that session.
Question 7: What is the function of an SSL/TLS Service Profile in PAN-OS, as distinct from a Decryption Profile?
- It defines decryption rules for user traffic
- It configures TLS protocol settings for the firewall's own management services (Correct answer)
- It stores CA certificates used for SSL Forward Proxy
- It monitors SSL decryption throughput and performance
Correct answer: It configures TLS protocol settings for the firewall's own management services
SSL/TLS Service Profiles configure TLS protocol versions and cipher suites for PAN-OS management plane services such as the web UI, GlobalProtect, and Captive Portal.
PCNSE SSL/TLS Decryption and Inspection 2
Which PAN-OS object contains settings for minimum TLS version, cipher suite restrictions, and certificate verification behavior for decrypted traffic?