Palo Alto Networks Certified Network Security Engineer (PCNSE)Core ConceptsHard
A network security administrator is configuring Decryption on a Palo Alto Networks firewall. The goal is to decrypt traffic for all internal users accessing external websites, except for specific financial and healthcare sites that must remain encrypted due to compliance. Which decryption method and configuration combination best achieves this goal?
- ASSL Forward Proxy with a Decryption Policy excluding specific URL categories.
- BSSH Proxy Decryption with a custom application filter.
- CNo Decryption policy, relying on URL Filtering for control.
- DSSL Inbound Inspection with a Decryption Profile for the internal server.
Show answer & explanationAnswer & explanation
Correct answer: A. SSL Forward Proxy with a Decryption Policy excluding specific URL categories.
SSL Forward Proxy decryption is used for decrypting traffic where the firewall is acting as a proxy for internal clients accessing external servers. By configuring a Decryption Policy with specific URL categories excluded, the administrator can decrypt most traffic while respecting compliance requirements for sensitive sites.
Why the other options are wrong
- B. SSH Proxy Decryption is specifically for SSH traffic, not general web (SSL/TLS) traffic.
- C. Relying only on URL Filtering does not allow for deep inspection of encrypted traffic, which is the primary goal of decryption.
- D. SSL Inbound Inspection is for decrypting traffic to internal servers, not for internal users accessing external websites.
SSL Forward Proxy Decryption
A decryption method where the firewall acts as an intermediary for client-to-server SSL/TLS connections, decrypting, inspecting, and then re-encrypting traffic.
- Used for client-to-external server traffic
- Firewall generates new certificates
- Enables deep inspection of encrypted outbound traffic
- Can exclude specific URL categories
Memory trick: To see inside the secure box, you need the right key, and sometimes, you leave some boxes untouched.