Exam PCNSE All Questions

View all questions & answers for the PCNSE exam

Exam PCNSE topic 1 question 454 discussion

Actual exam question from Palo Alto Networks's PCNSE

Question #: 454
Topic #: 1

An administrator is assisting a security engineering team with a decryption rollout for inbound and forward proxy traffic. Incorrect firewall sizing is preventing the team from decrypting all of the traffic they want to decrypt.

Which three items should be prioritized for decryption? (Choose three.)

A. Financial, health, and government traffic categories
B. Less-trusted internal IP subnets
C. Known malicious IP space
D. High-risk traffic categories
E. Public-facing servers

Show Suggested Answer

Suggested Answer: B 🗳️

by [deleted] at Dec. 20, 2022, 1:46 p.m.

Comments

Submit Cancel

[Removed]

Highly Voted 2 years, 7 months ago

CDE are correct answers

upvoted 24 times

evdw

2 years, 7 months ago

Agree on CDE

upvoted 6 times

Eiffelsturm

1 year, 8 months ago

why do you want to decrypt known malicious IPs? Block them

upvoted 15 times

...

lildevil

Highly Voted 2 years, 2 months ago

BDE, we all know why not A, but why would you decrypt C...if you block that traffic (as you should) then security profiles are not even applied (even if you set them on a blocking security profile, they wont take any affect) so why set up a decryption profile for it?

upvoted 20 times

...

network_enthusiast

Most Recent 1 month ago

Selected Answer: B

Correct answer is BDE

upvoted 1 times

...

mustfaozturknetworks

1 month, 3 weeks ago

Selected Answer: E

B,D,E C must be block. So it doesn’t make sense to make decrypt known traffic.

upvoted 1 times

...

Angelafp

5 months ago

Selected Answer: B

B,D,E has not sense to decrypt a know malicous IPs.. better to block them instead.

upvoted 2 times

...

de7cdfd

6 months, 1 week ago

Selected Answer: B

BCD is are correct.

upvoted 2 times

...

CarlosDV06

6 months, 2 weeks ago

Selected Answer: B

BDE. We do not decrypt A's due to compliance, and why would you waste FWs resources decrypting known malicious IP Addresses, you know they are malicious, so you block them (for example, Palo Alto bulletproof ip EDL).

upvoted 4 times

...

corpguy

8 months, 3 weeks ago

Selected Answer: B

BDE are correct, malicious sites (C) would be blocked, you would not waste resources decrypting them.

upvoted 1 times

...

Yohinar

9 months ago

Selected Answer: E

BDE - A you should never decrypt and C you should already block

upvoted 1 times

...

dtisolutions

10 months, 1 week ago

B D E , I agree A is out of the question , usually you should never decrypt those and C normally you already block

upvoted 1 times

...

0d2fdfa

1 year, 2 months ago

Selected Answer: C

CDE are correct answers

upvoted 1 times

...

evilCorpBot7494

1 year, 5 months ago

BDE. C should be blocked anyway so there is no need to decrypt it. A) Should not be decrypted due to regulations and privacy.

upvoted 3 times

...

Marshpillowz

1 year, 6 months ago

B, D and E

upvoted 1 times

...

franko_72

1 year, 7 months ago

B D E for sure.

upvoted 2 times

...

Andromeda1800

1 year, 8 months ago

My opinion is that B, D, E are correct. C shouldn't be correct because you are supposed to block Known malicious IP space and not decrypt it. Option A (Financial, health, and government traffic categories) usually is not supposed to be decrypted due to regulatory compliance and data privacy.

upvoted 2 times

...

brian7857ffs45

1 year, 8 months ago

This question was on the exam.. Nov 2023

upvoted 2 times

...

Xuzi

1 year, 8 months ago

Selected Answer: B

BDE for sure

upvoted 2 times

...

Load full discussion...