A company's security policy requires SSL Forward Proxy for all outbound HTTPS traffic. However, the finance department uses a legacy application that connects to a government portal requiring client certificates for authentication. Users report the application fails when decryption is enabled. What should the administrator do?

Disable SSL Forward Proxy for the entire finance department's subnet.

Install the forward trust certificate on the finance department's computers and retry the application.

Create a 'No Decrypt' rule for the government portal's domain and place it above the general SSL Forward Proxy rule.

Configure the firewall to forward the client certificate to the government portal during decryption.

In which scenario would a 'No Decrypt' rule be appropriate?

Traffic from a guest network that is already isolated.

Traffic that is already encrypted with strong encryption.

Traffic to a public website that is known to be safe.

Traffic to a banking website that uses certificate pinning and would break if decrypted.

Where should decryption policy rules be placed relative to security policy rules on a Palo Alto Networks firewall?

Security policy is evaluated before decryption policy, so decryption rules should be placed after security rules.

Decryption policy and security policy are evaluated in parallel, so order does not matter.

Decryption policy is only applied if the security policy allows the traffic.

Decryption policy is evaluated before security policy, so decryption rules should be ordered to match the traffic flow.

Which component is required on a Strata firewall to perform SSL Forward Proxy decryption?

A server certificate with a private key for each internal server.

A certificate revocation list (CRL) for all external servers.

A hardware security module (HSM) for key storage.

A forward trust certificate that is trusted by internal clients.

Which certificate management task is essential for SSL Inbound Inspection?

Installing a public CA certificate on the firewall.

Generating a self-signed certificate for the firewall.

Installing a forward trust certificate on all internal clients.

Installing the server's private key and certificate on the firewall.

Palo Alto NetworksCertified Network Security Professional

Domain 1Objective 3

1.3 Explain the Use of Decryption on Strata and SASE Products (e.g., SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, No Decrypt) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Part of the Network Security Fundamentals domain, which accounts for 17% of the NETWORK-SECURITY-PROFESSIONAL exam.

21questions here

5free pages

9concepts

17%of the exam

Questions 1–5

1application · medium
A company's security policy requires SSL Forward Proxy for all outbound HTTPS traffic. However, the finance department uses a legacy application that connects to a government portal requiring client certificates for authentication. Users report the application fails when decryption is enabled. What should the administrator do?
Select an answer first
2foundation · easy
In which scenario would a 'No Decrypt' rule be appropriate?
Select an answer first
3foundation · easy
Where should decryption policy rules be placed relative to security policy rules on a Palo Alto Networks firewall?
Select an answer first
4foundation · easy
Which component is required on a Strata firewall to perform SSL Forward Proxy decryption?
Select an answer first
5foundation · easy
Which certificate management task is essential for SSL Inbound Inspection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-PROFESSIONAL” is a trademark of its owner, used for identification only.