1.3 Explain the Use of Decryption on Strata and SASE Products (e.g., SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, No Decrypt) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of SSL Inbound Inspection on a Palo Alto Networks firewall?

   • ATo decrypt inbound traffic destined to internal servers so the firewall can inspect it for threats before it reaches the servers.
   • BTo decrypt outbound traffic from internal clients to external servers.
   • CTo decrypt SSH traffic to internal servers for command inspection.
   • DTo decrypt traffic between internal servers to enforce micro-segmentation.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How can a Palo Alto Networks firewall be configured to bypass decryption for specific traffic?

   • ABy using a NAT rule to redirect the traffic around the firewall.
   • BBy creating a 'No Decrypt' rule in the decryption policy that matches the traffic.
   • CBy disabling the decryption profile on the interface.
   • DBy creating a security rule that allows the traffic without inspection.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of SSL Forward Proxy decryption on a Palo Alto Networks firewall?

   • ATo decrypt outbound traffic from internal clients to external servers so the firewall can inspect the content for threats and policy compliance.
   • BTo re-encrypt traffic after inspection without changing the original session.
   • CTo decrypt inbound traffic destined to internal servers to protect them from external attacks.
   • DTo decrypt SSH traffic to inspect commands and prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has implemented SSL Forward Proxy. The legal department uses a web application that requires mutual TLS (mTLS) authentication, where the client presents a certificate. Users report the application fails. What is the most appropriate action?

   • AConfigure the firewall to forward the client certificate to the server during decryption.
   • BAdd the legal department's web application domain to a 'No Decrypt' exception rule.
   • CDisable SSL Forward Proxy for the entire legal department's subnet.
   • DInstall the forward trust certificate on the legal department's computers.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses Prisma Access (SASE) to secure remote users. They want to decrypt and inspect all outbound HTTPS traffic, but they need to exclude traffic to a specific SaaS application that uses certificate pinning. What is the most effective way to configure this?

   • ADisable SSL Forward Proxy for all remote users and rely on URL filtering only.
   • BUse SSL Inbound Inspection instead of SSL Forward Proxy for remote users.
   • CCreate a 'No Decrypt' rule for the SaaS application's domain in Prisma Access and place it above the general SSL Forward Proxy rule.
   • DConfigure the firewall to ignore certificate validation errors for the SaaS application.
   Reveal Solution Discussion Select an answer first