Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)

When implementing SSL Forward Proxy decryption, the firewall performs a man-in-the-middle (MITM) action. Two critical prerequisites must be evaluated to prevent application breakage. First, the firewall must validate the original server's certificate chain. If a server presents an incomplete chain, the firewall may be unable to establish trust, causing the session to fail. Second, some applications use certificate pinning, where the application is hard-coded to accept only a specific server certificate or public key. These applications will reject the certificate generated by the firewall during decryption, breaking the application's functionality. Therefore, identifying and creating policy exceptions for traffic with incomplete chains or pinned certificates is a mandatory prerequisite.

A. RADIUS profile: This is an authentication, authorization, and accounting (AAA) protocol profile used for user identification, not a technical prerequisite for the TLS decryption process.
D. SAML certificate: This is used for signing assertions in a single sign-on (SSO) identity federation context and is not directly related to the mechanics of decrypting general internet traffic.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "Decryption Exclusions".

This section explicitly states: "Some applications and websites don't work with decryption. For example, applications that use certificate pinning... must be excluded from decryption." This directly supports option C as a prerequisite to evaluate.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "Decryption Concepts", subsection "SSL Forward Proxy".

This section describes the process where the firewall intercepts the TLS handshake and validates the external server's certificate. The guide notes that if the certificate cannot be validated (e.g., due to an incomplete chain leading to an untrusted issuer), the firewall will block the session by default. This makes evaluating certificate chains a prerequisite (Option B).

3. Palo Alto Networks. (2021). SSL Decryption for the Next-Generation Firewall. White Paper.

Page 6, under "Challenges to Decryption," lists "Applications that use certificate pinning" as a primary reason why certain traffic cannot be decrypted and must be identified beforehand. This supports option C. The paper also details the certificate validation process performed by the firewall, reinforcing the need to handle chain-of-trust issues (Option B).