Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select 3 answers.
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Tricky question. Memorize this: you have three types of decryption actions 1. SSL Forward Proxy (acts as a proxy between the client and the server, so the client's certificate and the fw cert mus be the same). 2. SSL Inbound Inspection (for your servers exposed to the internet, the fw acts as if it were the server, so you import the server's cert and its private key). 3. SSH Proxy for SSH and SSH Tunnel (this last should be blocked as a BP). Besides, you can also forward decrypted traffic to an external appliance through decryption mirror, so you would need to ask for a license in the csp and configure your fw to send the clear text traffic to your appliance. A says "ssl outbound PROXYLESS..." so it basically results in completely the opposite of that ssl forward proxy does lmao. Kind of the same with D since you act as the server, meaning you could be "proxying" the session but thats not how it's called by PANW.
BCE The firewall provides three types of Decryption policy rules: SSL Forward Proxy to control outbound SSL traffic, SSL Inbound Inspection to control inbound SSL traffic, and SSH Proxy to control tunneled SSH traffic. You can attach a Decryption profile to a policy rule to apply granular access settings to traffic, such as checks for server certificates, unsupported modes, and failures. You can also use Decryption Mirroring to forward decrypted traffic as plaintext to a third party solution for additional analysis and archiving.
this answer conflicts with 189 on this list, decryption mirroring is counted as a rule profile or not? You can also use a Decryption policy rule to define Decryption Mirroring. On this question it is an answer and on 189 is not.