PCNSE · Question #785
A firewall administrator has confirmed reports of a website is not displaying as expected, and wants to ensure that decryption is not causing the issue. Which three methods can the administrator use…
The correct answer is B. Investigate decryption logs of the specific traffic to determine reasons for failure. C. Temporarily disable SSL decryption for all websites to troubleshoot the issue. E. Create a policy-based "No Decrypt" rule in the decryption policy to exclude specific traffic from. To determine if decryption is causing a website to fail, an administrator can review decryption logs, temporarily disable decryption, or create a specific 'No Decrypt' policy rule.
Question
A firewall administrator has confirmed reports of a website is not displaying as expected, and wants to ensure that decryption is not causing the issue. Which three methods can the administrator use to determine if decryption is causing the website to fail? (Choose three.)
Options
- AMove the policy with action decrypt to the top of the decryption policy rulebase.
- BInvestigate decryption logs of the specific traffic to determine reasons for failure.
- CTemporarily disable SSL decryption for all websites to troubleshoot the issue.
- DDisable SSL handshake logging.
- ECreate a policy-based "No Decrypt" rule in the decryption policy to exclude specific traffic from
How the community answered
(43 responses)- A21% (9)
- B70% (30)
- D9% (4)
Why each option
To determine if decryption is causing a website to fail, an administrator can review decryption logs, temporarily disable decryption, or create a specific 'No Decrypt' policy rule.
Moving a decrypt policy to the top would ensure decryption occurs earlier, but it does not help determine if decryption itself is the cause of a website failure.
Investigating decryption logs provides specific reasons for decryption failures, such as certificate errors or unsupported ciphers, which helps diagnose website issues.
Temporarily disabling SSL decryption globally is a quick troubleshooting step to confirm if decryption is the root cause of the website's display issues.
Disabling SSL handshake logging would remove critical debugging information that is essential for troubleshooting decryption-related problems.
Creating a policy-based 'No Decrypt' rule for the problematic traffic allows specific website access to bypass decryption, effectively isolating the issue without affecting other decrypted traffic.
Concept tested: SSL decryption troubleshooting
Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/decryption/troubleshoot-decryption
Topics
Community Discussion
No community discussion yet for this question.