1.2 Create and Apply Decryption Profiles NETWORK-SECURITY-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A company has configured SSL decryption with a decryption profile that logs all sessions. After a week, the security team wants to verify that decryption is working correctly for a specific internal application. Which log should they examine to confirm that sessions to this application are being decrypted?

   • AThreat logs, filtering for the application's IP address.
   • BSystem logs, filtering for the decryption profile name.
   • CTraffic logs, filtering for the application's IP address and the 'decrypted' action.
   • DConfig logs, filtering for the decryption policy rule.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which decryption profile setting determines what happens to traffic when the firewall is unable to decrypt it?

   • ACertificate Settings
   • BLogging Settings
   • CSSL/TLS Protocol Settings
   • DFailure Handling
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a decryption profile, which setting controls the minimum SSL/TLS protocol version that the firewall will accept for decrypted sessions?

   • ASSL/TLS Protocol Settings
   • BFailure Handling Settings
   • CCipher Suite Selection
   • DCertificate Settings
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following best describes the relationship between a decryption profile and a decryption policy rule?

   • AA decryption profile is applied to a decryption policy rule to define how decryption is performed for matching traffic
   • BA decryption policy rule is applied to a decryption profile to specify which traffic to decrypt
   • CDecryption profiles replace decryption policy rules in modern PAN-OS versions
   • DDecryption profiles and decryption policy rules are independent and do not interact
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a decryption profile that is set to 'block' on 'server certificate validation failure'. They apply this profile to a decryption policy rule that matches all outbound HTTPS traffic. After deployment, they find that some users cannot access a specific external website. The administrator verifies that the website's certificate is valid and trusted by the firewall. What is the most likely reason for the block?

   • AThe decryption policy rule is not matching the traffic correctly.
   • BThe website is using a certificate that is not in the firewall's trust store.
   • CThe decryption profile is also blocking sessions with 'unsupported version/cipher'.
   • DThe firewall's decryption profile is not applied to the correct zone.
   Reveal Solution Discussion Select an answer first