Exam PCNSE topic 1 question 320 discussion

question asks what two attributes of a certicate are required, not what type of certificates are required. answer is B and D

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-concepts/ssl-inbound-inspection "On the firewall, you must install the certificate and private key for each server for which you want to perform SSL Inbound Inspection"

probably poorly re-transripted: should read: a private key + THE server certificate. i guess.

While SANs are commonly recommended and may be required by modern browsers to avoid warnings, the Palo Alto documentation does not list SAN as a required attribute for SSL Inbound Inspection to function.

Attributes fellas

a server certificate is no attribute of a certificate + SAN Entry is required for all major browsers otherwise the browser will throw an error.

SAN (subject alternative name) is required these days on all major browsers otherwise browsers throw and error. Even if the CN field matches, browsers require SAN to match the inbound server URL.

I have never seen an exam written as bad as PCNSE. You need to have a server certificate with its private key to perform SSL Inbound Inspection. You can define SANs but they are not mandatory (in fact, you could deploy SSL Inbound Inspection WITHOUT defining any SAN).

The firewall needs the private key to decrypt the traffic, and the certificate of the server in order to properly perform decryption

Question is poorly worded however keep in mind that: Option D subject alternative name is irrelevant, this is only needed when one cert needs to cover multiple websites. For inbound decryption, you need the server certificate for the site and its private key.

B is necessary. C I guess is the cert of the server that will be accessed by the users in the internet

On the firewall, you must install the certificate and private key for each server for which you want to perform SSL Inbound Inspection. The firewall validates that the certificate sent by the targeted server during the SSL/TLS handshake matches a certificate in your Decryption policy rule. If there is a match, the firewall forwards the server's certificate to the client requesting server access and establishes a secure connection.

B and C as You can upload the server certificate and private key alone to the firewall if your web server supports only TLS 1.2 and the RSA key exchange algorithm and the server’s certificate chain (if the leaf certificate is signed by intermediate certificates) is installed on the server. SSL Inbound Inspection discusses each case in more detail. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-inbound-inspection

Poorly worded question but I say C because usually the intention of the question is not to be so tricky and shady. In our scenario there is no known requirement for SAN, so I'm thinking to not focus so specifically on the word attributes. The cert *must* have a private key and would need to support server authentication. I understand why many are suggesting D though due to the specific attribute verbiage.

It is a poorly written question but I guess they want us to go for B and C.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-concepts/ssl-inbound-inspection

I got this question in the exam