Exam PCNSE topic 1 question 603 discussion

I think the answer should be B since RSA is less resource intesive than ECDSA

If firewall resources are an issue, use stronger decryption for higher-priority traffic and use less processor-intensive decryption to decrypt and inspect lower-priority traffic until you can increase the available resources. For example, you could use RSA instead of ECDHE and ECDSA for traffic that isn’t sensitive or high-priority to preserve firewall resources for using PFS-based decryption for higher priority, sensitive traffic.

"Perfect Forward Secrecy (PFS) ephemeral key exchange algorithms such as Diffie-Hellman Ephemeral (DHE) Elliptic-Curve Diffie-Hellman Exchange (ECDHE) consume more processing resources than Rivest-Shamir-Adleman (RSA) algorithms"

The answer is D. ECDSA uses less computational power, memory, and energy, making it suitable for devices with limited resources Please update at the correct answer.

from chat GPT :) ECDSA is generally less resource-consumptive than RSA in an NGFW decryption policy due to its lower computational complexity and smaller key sizes for equivalent security levels. This makes ECDSA the preferred choice in environments where performance and resource optimization are critical.

this was in my exam 09/08/2024

Based on (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/prepare-to-deploy-decryption/size-the-decryption-firewall-deployment). You could use RSA instead of ECDHE and ECDSA for traffic that isn’t sensitive or high-priority to preserve firewall resources for using PFS-based decryption for higher priority, sensitive traffic. > Answer should be B based on the official documentation.

D....Key size. The RSA algorithm uses significantly larger cryptographic keys than ECDSA. To reach 128-bit security, RSA needs to use keys that are at least 3072 bits in length. Meanwhile, it's sufficient for ECDSA to generate public keys twice the size of the desired 128-bit security to reach this standard.

should be D, ECDSA runs faster than RSA. It also requires significantly less memory.

Agree B

SSL Forward Proxy and SSL Inbound Inspection do two different jobs, and the way the question is phrased they could both be on. The answer, without turning anything off is to use a less intensive decryption/encryption method - Answer is B

Agree B. RSA is less secure but also less cpu intensive, hence it can be used for less sensitive traffic.