How does enabling SSL decryption affect the firewall's memory usage?

Memory usage increases because each SSL session requires additional state and buffer space.

Memory usage increases only when the firewall is configured to decrypt all traffic, not selective decryption.

Memory usage is unaffected because SSL decryption is a CPU-only operation.

Memory usage decreases because decrypted traffic is smaller.

A company is comparing two PA-Series models for a branch office. Model X has a higher SSL decryption throughput but a lower session rate than Model Y. The branch office has a high number of short-lived HTTPS sessions (e.g., API calls) but low overall throughput. Which model is more appropriate for this branch office?

Either model, because SSL decryption performance is the same across all PA-Series models.

Model X, because SSL decryption throughput is more important than session rate for all traffic patterns.

Model X, because higher SSL decryption throughput is always the most important factor.

Model Y, because the branch's traffic pattern is session-rate-intensive, and Model Y can handle the high session rate.

A network administrator notices that after enabling SSL decryption on their PA-Series firewall, the CPU utilization is consistently above 80% during peak hours, and the firewall's throughput has dropped by 50%. What is the most likely cause of this performance degradation?

The firewall's session table is full because SSL decryption creates multiple sessions for each connection.

The firewall is not using hardware acceleration for SSL decryption, so all decryption is done by the CPU.

The firewall's SSL decryption throughput is lower than the actual HTTPS traffic volume, causing the CPU to become the bottleneck.

The firewall is running out of memory because SSL decryption requires storing all decrypted traffic in memory.

A company is evaluating SSL decryption performance on their PA-Series firewall. They notice that the throughput for TLS 1.3 sessions with forward secrecy is significantly lower than for TLS 1.2 sessions with RSA key exchange. What is the primary reason for this performance difference?

TLS 1.3 uses more CPU-intensive cryptographic algorithms than TLS 1.2.

TLS 1.3 sessions are longer-lived and consume more memory, reducing throughput.

TLS 1.3 requires the firewall to store more session state, reducing available CPU for decryption.

TLS 1.3 is not supported by Palo Alto Networks firewalls, so performance is degraded.

Which platform capability is most important to compare when selecting a PA-Series model for SSL inspection?

Maximum number of SSL certificates that can be installed

Dedicated SSL decryption throughput

Palo Alto NetworksCertified Network Security Architect

Domain 10Objective 8

10.8 Evaluate SSL Inspection Sizing Requirements NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the Private Cloud (PA-Series, VM-Series, Hypervisors) domain, which accounts for 10% of the NETWORK-SECURITY-ARCHITECT exam.

17questions here

4free pages

5concepts

10%of the exam

Questions 11–15

11foundation · easy
How does enabling SSL decryption affect the firewall's memory usage?
Select an answer first
12application · medium
A company is comparing two PA-Series models for a branch office. Model X has a higher SSL decryption throughput but a lower session rate than Model Y. The branch office has a high number of short-lived HTTPS sessions (e.g., API calls) but low overall throughput. Which model is more appropriate for this branch office?
Select an answer first
13application · medium
A network administrator notices that after enabling SSL decryption on their PA-Series firewall, the CPU utilization is consistently above 80% during peak hours, and the firewall's throughput has dropped by 50%. What is the most likely cause of this performance degradation?
Select an answer first
14application · medium
A company is evaluating SSL decryption performance on their PA-Series firewall. They notice that the throughput for TLS 1.3 sessions with forward secrecy is significantly lower than for TLS 1.2 sessions with RSA key exchange. What is the primary reason for this performance difference?
Select an answer first
15foundation · easy
Which platform capability is most important to compare when selecting a PA-Series model for SSL inspection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.