PCNSE · Question #397
Which two features require another license on the NGFW? (Choose two.)
The correct answer is C. Decryption Mirror D. Decryption Broker. SSL Inbound Inspection (A) and SSL Forward Proxy (B) are core PAN-OS decryption capabilities included with the base platform - they do not require additional licensing. In contrast, Decryption Mirror (C) requires a separate license; it enables the firewall to copy decrypted…
Question
Which two features require another license on the NGFW? (Choose two.)
Options
- ASSL Inbound Inspection
- BSSL Forward Proxy
- CDecryption Mirror
- DDecryption Broker
How the community answered
(23 responses)- A9% (2)
- B4% (1)
- C87% (20)
Explanation
SSL Inbound Inspection (A) and SSL Forward Proxy (B) are core PAN-OS decryption capabilities included with the base platform - they do not require additional licensing. In contrast, Decryption Mirror (C) requires a separate license; it enables the firewall to copy decrypted traffic to a network tap or security device (such as a DLP tool or forensic recorder) for out-of-band inspection. Decryption Broker (D) also requires an additional license; it allows the firewall to forward decrypted traffic to third-party inline security devices (such as a next-gen IPS or DLP appliance) before re-encrypting and forwarding to the destination. Both of these advanced decryption capabilities are licensed add-ons because they involve integrating external security tools into the decryption workflow.
Topics
Community Discussion
No community discussion yet for this question.