Exam PCNSE topic 1 question 109 discussion

A Always from the traffic log. Whether it is drilling down into traffic log details or enabling the decryption column. Acquaint yourself with this reference: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/verify-decryption.html

The question is about "log file" and SSL decrypt failures. ACC isn't a log file. SLL decrypt failures you can see on Decryption log and in Traffic log (Session End Reason column)

B is correct according to the documentation. The most common reasons for decryption failures are TLS protocol errors, cipher version errors (client and server version mismatches and client and Decryption profile version mismatches), and certificate errors. To investigate decryption errors, start with the Application Command Center (ACC) to identify failures and then go to the Decryption logs to drill down into details. Option is is Traffic and NOT "Decryption logs" https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-troubleshooting-workflow-examples/investigate-decryption-failure-reasons

B: Is the correct answer. ACC>SSL Activity>Decryption failure reasones Give you the information about the failure. Traffic log can you verify if the treffic is encrypted or not. There are no details about the failure.

A is correct

ACC is not a log file . The question is about "Which log file", so A should be the correct one.

I am going to go with B https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-troubleshooting-workflow-examples/investigate-decryption-failure-reasons WHat people are selecting is for validating if decryption was used, but not for specific failures.

View Decrypted Traffic Sessions—Filter the Traffic Logs (MonitorLogsTraffic) using the filter ( flags has proxy ) https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/verify-decryption#id185BG0KL0W1

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/verify-decryption

Another tricky question, very common with PANW tests. While I agree with "A", if you go to "Monitor > Decryption" you will see an "Error" and "Error Index" column (if you don't see it, you can enable it). The Traffic log will only tell you if a session was decrypted or not, but no-decrypted traffic doesn't always mean a failure, it could often mean there's a decryption policy with action "no decrypt" or an SSL decryption exclusion or an error. Something to think about...

A because ACC isn't a log file

I think that correct answer is B PANOS Guide. Investigate Decryption Failure Reasons Begin your investigation at ACC>SSL Activity and look at the Decryption Failure Reasons widget https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-troubleshooting-workflow-examples/investigate-decryption-failure-reasons.html#id1eee110d-3799-45ef-a4b0-e5e7fbd157af

Confirmed that the answer is A Traffic. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/verify-decryption.html

IMHO: A - traffic log specifically check session end reason where decrypted=yes and action=allowed. you'll see errors such as decrypt-error decrypt-cert-validation

The following tools provide full visibility into the TLS handshake and help you troubleshoot and monitor your decryption deployment: ACC - SSL Activity Monitor - Logs - Decryption So as there is no Decryption listed as answer, ACC fits. Correct answer is: A

PCNSE is based on PANOS10 https://live.paloaltonetworks.com/t5/certification-articles/pcnse-and-pcnsa-exam-changes-with-10-0/ta-p/344832 Could be B: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-release-information/features-introduced-in-pan-os-10-0/decryption-features.html#ida1eb9d8c-515e-4e88-b217-1ebc025a45d4 "Use the new ACC features to identify traffic for which decryption causes problems and then use the new Decryption logs to drill down into details and solve the problem."

B - as from PAN-OS 10, troubleshooting SSL in done in the following process: 1. Check ACC decryption widgets to identify traffic that causes decryption issues 2. Drill down further using the Decryption Log. It is not A because that simply tells you if the traffic was or was not decrypted. It does not in any way provide you with a means for troubleshooting. The question is asking you to troubleshoot. Read "Troubleshoot and Monitor Decryption" for PAN-OS 10. It clearly lists your troubleshooting process for SSL decryption issues https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption.html