An engineer must configure the Decryption Broker feature. Which Decryption Broker security chain supports bi-directional traffic flow?

The correct answer is B. Layer 3 security chain. The Decryption Broker feature allows a Palo Alto Networks firewall to decrypt SSL/TLS traffic and forward it to third-party security chain devices for additional inspection. In a Layer 3 security chain, the firewall routes decrypted traffic to and from the security chain…

Submitted by luis.pe· Apr 18, 2026Deploy and Configure

Question

Options

ALayer 2 security chain
BLayer 3 security chain
CTransparent Bridge security chain
DTransparent Proxy security chain

How the community answered

(41 responses)

A
2% (1)
B
88% (36)
C
2% (1)
D
7% (3)

Explanation

The Decryption Broker feature allows a Palo Alto Networks firewall to decrypt SSL/TLS traffic and forward it to third-party security chain devices for additional inspection. In a Layer 3 security chain, the firewall routes decrypted traffic to and from the security chain devices using routed Layer 3 interfaces, which natively supports bi-directional (ingress and egress) traffic flow. Layer 2 and Transparent Bridge chains operate at Layer 2 and do not inherently support bidirectional routing the same way. Transparent Proxy chains use a different inspection model and are not designed for general bi-directional broker traffic.

Topics

#Decryption Broker#Security Chains#Traffic Forwarding#Layer 3 Networking

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice