Exam PCNSE topic 1 question 311 discussion

From the question "...websites are required for corporate users to access". From this we can infer that access to the websites is required by the customer/business which means the sites shouldn't be blocked, even if from a security standpoint we would prefer it so C can be correct.

Pretty sure this was on the exam, has to be C. July 2023

C: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions Traffic that breaks decryption for technical reasons, such as using a pinned certificate, an incomplete certificate chain, unsupported ciphers, or mutual authentication (attempting to decrypt the traffic results in blocking the traffic). Palo Alto Networks provides a predefined SSL Decryption Exclusion list (DeviceCertificate ManagementSSL Decryption Exclusion) that excludes hosts with applications and services that are known to break decryption technically from SSL Decryption by default. If you encounter sites that break decryption technically and are not on the SSL Decryption Exclusion list, you can add them to list manually by server hostname. The firewall blocks sites whose applications and services break decryption technically unless you add them to the SSL Decryption Exclusion list.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-exclusions

C question already says unsupported cypher sites are needed for corp access, so shall not be decrypted --> exemption for them

unsupported ciphers is not a valid reason to add the url to the exclution list. Only cert pinning og mutual auth is. The answer must be D.