2.3 Create and Apply Decryption Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of a decryption profile in a decryption policy?

   • ATo control SSL/TLS versions, certificate settings, and failure handling
   • BTo define the source and destination addresses for decryption
   • CTo specify the action to take on decrypted traffic, such as allow or deny
   • DTo determine which security policy applies to decrypted traffic
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   If a decryption policy with action 'no-decrypt' is placed above a policy with action 'decrypt' for the same traffic, what will happen?

   • AThe traffic will not be decrypted because the first matching policy is applied
   • BThe firewall will use the decrypt policy because decryption is the default action
   • CThe traffic will be decrypted because the decrypt policy is more specific
   • DThe firewall will generate an error and block the traffic
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An administrator has configured a decryption policy to inspect HTTPS traffic from a specific subnet. After testing, they find that some HTTPS sessions are not being decrypted. The traffic logs show that these sessions have 'No Decrypt' as the decryption action. What is the most likely reason?

   • AA 'No Decrypt' policy is matching the traffic before the intended decrypt policy.
   • BThe decryption profile has 'No Decrypt' set as the failure action.
   • CThe firewall's certificate is not trusted by the client, so it falls back to no decryption.
   • DThe security policy is set to 'Allow' without decryption.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is deploying SSL decryption and wants to ensure that clients trust the firewall's decryption certificate. They have generated a CA-signed certificate for the firewall. What additional configuration is required for decryption to work without client certificate errors?

   • AAdd the firewall's certificate to the security policy's 'Decryption' tab.
   • BConfigure the decryption profile to use 'Forward Proxy' and set the certificate to 'None'.
   • CDistribute the firewall's CA certificate to all client devices as a trusted root certificate.
   • DEnable 'Block sessions with unsupported versions' in the decryption profile.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of an SSL/TLS decryption policy on a Palo Alto Networks firewall?

   • ATo block all encrypted traffic that does not match an existing security policy
   • BTo replace the need for security policies by directly blocking malicious encrypted traffic
   • CTo allow the firewall to inspect encrypted traffic for threats and enforce security policies
   • DTo encrypt traffic between the firewall and internal servers to protect data in transit
   Reveal Solution Discussion Select an answer first