Exam PSE-SASE topic 1 question 25 discussion

SSL Inbound Proxy ecryption mode can only work if you have control on the targeted Web Server certificate to be allow to import Key Pair on Palo Alto Networks Device. That's why this decryption mode is often use to decrypt SSL inbound traffic to Internal Web Server. Since in the question they talk about IN THE DATA CENTER, it needs to be this one. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV8CAK

SSL Inbound inspection not even exist. The decryption on this scenario it's applied to users when they access to the server.

The real answer is "SSL Forward Proxy" on the Mobile User policy, for two reasons. 1) SSL Inbound Proxy is not a real thing. It is SSL Inbound Inspection, and it does not PROXY any connections; the client connects directly to the server and there is no man-in-the-middle proxy from the firewall. 2) The question mentions "DC/datacenter" and with Prisma Access you will have these deployed as Service Connections 99% of the time. Service Connections do not support policies like decryption, nat, and security.

D. SSL Forward Proxy. SSL inbound proxy isnt a thing... it's SSL inbound inspection.

Since it's referring to internal users and SC-CAN do not enforce security, it would be SSL outbound proxy, that hits the users connecting from remote networks or as Mobile Users.

Choosing "B" although SSL Inbound INSPECTION is not a proxy.