Exam PCNSE topic 1 question 454 discussion

CDE are correct answers

BDE, we all know why not A, but why would you decrypt C...if you block that traffic (as you should) then security profiles are not even applied (even if you set them on a blocking security profile, they wont take any affect) so why set up a decryption profile for it?

BDE are correct, malicious sites (C) would be blocked, you would not waste resources decrypting them.

BDE - A you should never decrypt and C you should already block

B D E , I agree A is out of the question , usually you should never decrypt those and C normally you already block

CDE are correct answers

BDE. C should be blocked anyway so there is no need to decrypt it. A) Should not be decrypted due to regulations and privacy.

B, D and E

B D E for sure.

My opinion is that B, D, E are correct. C shouldn't be correct because you are supposed to block Known malicious IP space and not decrypt it. Option A (Financial, health, and government traffic categories) usually is not supposed to be decrypted due to regulatory compliance and data privacy.

This question was on the exam.. Nov 2023

BDE for sure

changing my answer to BDE you should block C

should be C D E

I feel that B D E are correct https://docs.paloaltonetworks.com/best-practices/9-1/data-center-best-practices/data-center-best-practice-security-policy/how-to-decrypt-data-center-traffic Within the data center, decrypt as much east-west traffic as possible.If performance considerations due to incorrect firewall sizing prevent you from decrypting all traffic, prioritize the most critical servers, the highest risk traffic categories, and less trusted segments and IP subnets Answer: B. Less-trusted internal IP subnets >> less trusted segments and IP subnets D. High-risk traffic categories >> the highest risk traffic categories E. Public-facing servers >> prioritize the most critical servers meaning any servers that the company host that is protected by PAN FW > Therefore: prioritize the most critical servers,

A, C e D

I would go with BDE. C does not make any sense. You should block known malicious ip addresses with a an EDL in a security policy, not decrypt it.