Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
To et Inbound decryption working you need: 1. server cert from the target server 2. the private key of the server 3. NAT policy 4. Security Rule A is Correct
The correct answer is: C. Root certificate imported into the firewall with "Trust" enabled Explanation: Inbound decryption on a Palo Alto Networks firewall involves decrypting traffic that is sent to servers behind the firewall (e.g., HTTPS traffic to a web server). For this to work, the firewall must have the appropriate root certificate imported and marked as "Trusted". If the root certificate is not imported or not trusted, the firewall cannot validate the server's certificate, leading to decryption failures.
From Palo Alto's TechDocs: "HSM clients integrated with Palo Alto Networks firewalls and Panorama enable enhanced security for the private keys used in SSL/TLS decryption (both SSL forward proxy and SSL inbound inspection). In addition, you can use the HSM to encrypt master keys." Answer A is WRONG: the security policy allowing SSL will affect encrtypted traffic to'from the server. It has NO bearing on the decryption process. The question never mentioned problems with traffic to/from the original server. It only said issues with decryption.