Which two actions must an engineer take to configure SSL Forward Proxy decryption? (Choose two.)

To enable SSL Forward Proxy, the firewall must intercept traffic between a client and a server. This requires two fundamental configurations. First, a Forward Trust Certificate (B) must be generated on the firewall and deployed to clients. This allows the client's browser to trust the certificate the firewall presents when it impersonates the external server. Second, a Decryption policy rule (C) must be created to define which specific traffic sessions should be decrypted. Without this rule, the firewall will not apply decryption to any traffic, even if a certificate is present.

A. Configure the decryption profile: While a decryption profile is applied in the decryption rule to handle protocol checks and errors, a default profile exists. The rule itself is the mandatory component that enables decryption.
D. Configure a SSL/TLS service profile: This profile is used for SSL Inbound Inspection, where the firewall protects an internal server. It is not used for SSL Forward Proxy, which decrypts outbound client traffic.

1. Palo Alto Networks Administrator's Guide (PAN-OS 10.2): Configure SSL Forward Proxy. The workflow explicitly lists "Generate a Forward Trust certificate..." and "Create a Decryption policy rule..." as the primary steps to enable the feature.

2. Palo Alto Networks Administrator's Guide (PAN-OS 10.2): Decryption Concepts > SSL Forward Proxy. This section explains the mechanism: "To perform SSL Forward Proxy decryption, the firewall uses two certificates: a Forward Trust certificate and a Forward Untrust certificate... you must install the Forward Trust certificate in the trust store of each client browser..."

3. Palo Alto Networks Administrator's Guide (PAN-OS 10.2): Decryption Policy. This section states, "Decryption policy rules enable you to control which traffic to decrypt... If you do not configure and commit any Decryption policy rules, the firewall can’t decrypt traffic."

4. Palo Alto Networks Administrator's Guide (PAN-OS 10.2): Objects > Decryption > SSL/TLS Service Profile. This document clarifies the profile's purpose: "To protect servers from protocol vulnerabilities and weak ciphers, you can attach an SSL/TLS Service profile to a Decryption policy rule that decrypts inbound traffic." This confirms its use for inbound, not forward proxy, decryption.