If an administrator does not possess a website's certificate, which SSL decryption mode will allow the Palo Alto networks NGFW to inspect when users browse to HTTP(S) websites?

The correct answer is A. SSL Forward Proxy. SSL Forward Proxy is used to decrypt and inspect outbound SSL/TLS traffic initiated by internal users browsing to external websites. The firewall intercepts the connection, presents its own CA-signed certificate to the client, and establishes a separate SSL session to the…

Submitted by chen.hong· Apr 18, 2026Core Concepts

Question

Options

ASSL Forward Proxy
BSSL Inbound Inspection
CTLS Bidirectional proxy
DSSL Outbound Inspection

How the community answered

(36 responses)

A
89% (32)
B
6% (2)
C
3% (1)
D
3% (1)

Explanation

SSL Forward Proxy is used to decrypt and inspect outbound SSL/TLS traffic initiated by internal users browsing to external websites. The firewall intercepts the connection, presents its own CA-signed certificate to the client, and establishes a separate SSL session to the destination server - without needing the destination server's private key or certificate. SSL Inbound Inspection (B) is used for inbound traffic to internal servers and requires the server's actual private key/certificate. TLS Bidirectional Proxy (C) is not a valid PAN-OS decryption mode name. SSL Outbound Inspection (D) is not a valid PAN-OS mode. SSL Forward Proxy is the correct and only mode applicable when you do not own the destination server's certificate.

Topics

#SSL Decryption#SSL Forward Proxy#Network Security#NGFW Features

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice