exam questions

Exam PCNSE All Questions

View all questions & answers for the PCNSE exam

Exam PCNSE topic 1 question 448 discussion

Actual exam question from Palo Alto Networks's PCNSE
Question #: 448
Topic #: 1
[All PCNSE Questions]

A network security administrator wants to begin inspecting bulk user HTTPS traffic flows egressing out of the internet edge firewall.

Which certificate is the best choice to configure as an SSL Forward Trust certificate?

  • A. A Machine Certificate for the firewall signed by the organization’s PKI
  • B. A web server certificate signed by the organization’s PKI
  • C. A subordinate Certificate Authority certificate signed by the organization’s PKI
  • D. A self-signed Certificate Authority certificate generated by the firewall
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
bearfromdownunder
Highly Voted 1 year, 9 months ago
Selected Answer: C
Regardless of whether you generate Forward Trust certificates from your Enterprise Root CA or use a self-signed certificate generated on the firewall, generate a separate subordinate Forward Trust CA certificate for each firewall. The flexibility of using separate subordinate CAs enables you to revoke one certificate when you decommission a device (or device pair) without affecting the rest of the deployment and reduces the impact in any situation in which you need to revoke a certificate. Separate Forward Trust CAs on each firewall also helps troubleshoot issues because the CA error message the user sees includes information about the firewall the traffic is traversing. If you use the same Forward Trust CA on every firewall, you lose the granularity of that information.
upvoted 11 times
...
Marshpillowz
Most Recent 9 months ago
Selected Answer: C
I think C
upvoted 1 times
...
Kaifus
9 months, 4 weeks ago
Selected Answer: C
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-forward-proxy (Recommended Best Practice) Enterprise CA-signed Certificates
upvoted 1 times
...
brian7857ffs45
11 months, 1 week ago
This question was on the exam.. Nov 2023
upvoted 2 times
...
lildevil
1 year, 4 months ago
Selected Answer: D
D is correct. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV8CAK Under the first diagram we have "In Forward-Proxy mode, PAN-OS will intercept the SSL traffic which is matching the policy and will be acting as a proxy (MITM) generating a new certificate for the accessed URL. This new certificate will be presented during SSL Handshake to the Client accessing website with SSL. This certificate will be signed with the self-signed CA certificate or another certificate specified as:"
upvoted 1 times
...
Marbot
1 year, 8 months ago
Agreed with bearfromdownunder Reference: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy
upvoted 2 times
...
Marbot
1 year, 8 months ago
Selected Answer: C
Agreed with bearfromdownunder Reference: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy
upvoted 1 times
...
TheIronSheik
1 year, 8 months ago
Selected Answer: C
C, if you already have an Enterprise CA, then the clients will have it already installed. Therefore, I'm going with C
upvoted 2 times
...
djedeen
1 year, 9 months ago
Selected Answer: C
C - only choice with subordinate cert, can be either from org's PKI or self-signed. Regardless of whether you generate Forward Trust certificates from your Enterprise Root CA or use a self-signed certificate generated on the firewall, generate a separate subordinate Forward Trust CA certificate for each firewall.
upvoted 3 times
...
evdw
1 year, 10 months ago
Selected Answer: C
Correct answer is C You'll need some kind of trusted CA certificate to generate a server certificate that you present to internal clients for each website
upvoted 3 times
...
Maryamk
1 year, 10 months ago
D is correct Regardless of whether you generate Forward Trust certificates from your Enterprise Root CA or use a self-signed certificate generated on the firewall, generate a separate subordinate Forward Trust CA certificate for each firewall. The flexibility of using separate subordinate CAs enables you to revoke one certificate when you decommission a device (or device pair) without affecting the rest of the deployment and reduces the impact in any situation in which you need to revoke a certificate. Separate Forward Trust CAs on each firewall also helps troubleshoot issues because the CA error message the user sees includes information about the firewall the traffic is traversing. If you use the same Forward Trust CA on every firewall, you lose the granularity of that information. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy
upvoted 1 times
...
ExamQnA
1 year, 10 months ago
Selected Answer: B
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy : (Best Practice) Enterprise CA-signed Certificates
upvoted 1 times
Shoieb
1 year, 10 months ago
I think you wanted C not B
upvoted 2 times
...
...
Kaspinas
1 year, 10 months ago
Selected Answer: D
Answer D: The firewall can use certificates signed by an enterprise certificate authority (CA) or self-signed certificates generated on the firewall as Forward Trust certificates to authenticate the SSL session with the client. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy
upvoted 2 times
ConfuzedOne
1 year, 5 months ago
While you can use self-signed certificate, the "BEST" choice is C. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward-proxy (Best Practice ) Enterprise CA-signed Certificates —An enterprise CA can issue a signing certificate that the firewall can use to sign the certificates for sites that require SSL decryption. When the firewall trusts the CA that signed the certificate of the destination server, the firewall can send a copy of the destination server certificate to the client, signed by the enterprise CA. This is a best practice because usually all network devices already trust the enterprise CA (it is usually already installed in the devices’ CA Trust storage), so you don’t need to deploy the certificate on the endpoints, so the rollout process is smoother.
upvoted 1 times
...
...
[Removed]
1 year, 10 months ago
Selected Answer: C
C is correct
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago