nerdexam
Palo_Alto_Networks

PCNSE · Question #779

An administrator has a Palo Alto Networks NGFW. All security subscriptions and decryption are enabled and the system is running close to its resource limits. Knowing that using decryption can be resou

The correct answer is B. Use RSA instead of ECDSA for traffic that isn't sensitive or high-priority.. To reduce the CPU load on a firewall performing decryption, use RSA instead of ECDSA for traffic that is not sensitive or high-priority.

Submitted by kavita_s· Apr 18, 2026Operate

Question

An administrator has a Palo Alto Networks NGFW. All security subscriptions and decryption are enabled and the system is running close to its resource limits. Knowing that using decryption can be resource-intensive, how can the administrator reduce the load on the firewall?

Options

  • AUse SSL Forward Proxy instead of SSL Inbound Inspection for decryption.
  • BUse RSA instead of ECDSA for traffic that isn't sensitive or high-priority.
  • CUse the highest TLS protocol version to maximize security.
  • DUse ECDSA instead of RSA for traffic that isn't sensitive or high-priority.

How the community answered

(39 responses)
  • A
    10% (4)
  • B
    85% (33)
  • C
    3% (1)
  • D
    3% (1)

Why each option

To reduce the CPU load on a firewall performing decryption, use RSA instead of ECDSA for traffic that is not sensitive or high-priority.

AUse SSL Forward Proxy instead of SSL Inbound Inspection for decryption.

SSL Forward Proxy and SSL Inbound Inspection are different deployment methods for decryption and switching between them does not inherently reduce the overall resource load.

BUse RSA instead of ECDSA for traffic that isn't sensitive or high-priority.Correct

ECDSA (Elliptic Curve Digital Signature Algorithm) is generally more computationally intensive for the firewall's CPU than RSA during decryption, so prioritizing RSA for appropriate traffic can reduce the overall processing load.

CUse the highest TLS protocol version to maximize security.

Using the highest TLS protocol version maximizes security but typically increases computational complexity for decryption, which would increase rather than reduce the firewall's load.

DUse ECDSA instead of RSA for traffic that isn't sensitive or high-priority.

ECDSA is generally more resource-intensive for the firewall than RSA for decryption; therefore, using ECDSA more frequently would increase the load, not reduce it.

Concept tested: Decryption performance optimization via ciphers

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/decryption/decryption-policy/ssl-decrypt-profile/configure-an-ssl-decrypt-profile

Topics

#Decryption Performance#Resource Optimization#SSL Inspection#Cryptographic Ciphers

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSE Practice