Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A. web-browsing and 443 Explanation: When traffic to https://www.microsoft.com is decrypted by a Palo Alto Networks firewall: Application: The decrypted traffic is classified as web-browsing (since it’s HTTP/HTTPS web traffic). Service/Port: The original encrypted traffic uses port 443 (HTTPS), and this port is retained in the logs even after decryption. Why Not the Other Options? B. SSL and 80 → Incorrect. Port 80 is for HTTP (unencrypted), and "SSL" is not the app name after decryption. C. SSL and 443 → "SSL" is the application name before decryption. Once decrypted, it becomes web-browsing. D. web-browsing and 80 → Port 80 is for HTTP, but Microsoft’s site uses HTTPS (port 443). Key Notes: Before decryption: App = ssl, Port = 443. After decryption: App = web-browsing, Port = 443 (retained from original flow). Thus, A is correct for decrypted packets.
As the question asks about the application after packet decryption, it will see the application as Web-Browsing with port 443.
As mentioned before, application is identified as ssl and then web browsing after decryption.