Exam PCNSE topic 1 question 262 discussion

It asks which 'interface' , Decryption mirror is not an interface

Ans is D

Should be A. Decryption Mirror should mainly for DLP kind of devices, without coming "back" traffic.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-security-chain-layer-3#id182QM0B0S9D

it is a nasty question. I guess it receives on the decryption mirror and forwards out layer 3.

Decryption Broker: Forwarding Interfaces A firewall enabled as a decryption broker uses a pair of dedicated Layer 3 interfaces to forward decrypted traffic to a security chain for inspection. The decryption forwarding interfaces must be assigned to a brand new virtual router https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-forwarding-interfaces

Answer: A - layer 3 "A firewall enabled as a decryption broker uses a pair of dedicated Layer 3 interfaces to forward decrypted traffic to a security chain for inspection. " https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/decryption-broker-concepts/decryption-broker-forwarding-interfaces

Follow these guidelines to set up Layer 3 security chain devices to support decryption broker: Configure security chain devices with Layer 3 interfaces to connect to the security chain network. These Layer 3 interfaces must have an assigned IP address and subnet mask.

This is a shitty question. Assuiming, the firewall is decrypting the traffic, I would go with D: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/decryption-mirroring.html Assuming the firewall is part of a Security Chain and the traffic is already decrypted (not decrypted on the firewall), I would go with A: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/network-packet-broker/configure-routed-layer-3-security-chains

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/network-packet-broker/configure-routed-layer-3-security-chains

Initially thought it was D but A is correct. Configure security chain devices with Layer 3 interfaces to connect to the security chain network. These Layer 3 interfaces must have an assigned IP address and subnet mask. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/decryption-broker/security-chain-layer-3-guidelines.html