Which two configuration items are required when the NGFW needs to act as a decryption broker for multiple transparent bridge security chains? (Choose two.)

When configuring a Palo Alto Networks NGFW as a decryption broker for multiple security chains using transparent bridging, specific components are required for each chain to ensure proper traffic segmentation and forwarding. For each separate security tool chain, you must configure a dedicated pair of Layer 2 interfaces for sending and receiving traffic. Additionally, a unique Decryption policy rule must be created for each chain. This rule identifies the specific traffic to be decrypted and forwarded to its corresponding security chain via an attached Decryption Forwarding profile.

B. a unique Transparent Bridge Decryption Forwarding Profile to a single Decryption policy rule: While a profile is used, the primary requirement is a unique Decryption policy rule per chain, not a unique profile per rule.
D. a single pair of decryption forwarding interfaces: This is incorrect. A single pair of interfaces cannot be used for multiple transparent bridge chains; a dedicated pair is required for each chain.

1. Palo Alto Networks. (2022). PAN-OS® Administrator’s Guide Version 10.2. "Configure Decryption Broker with Transparent Bridge", pp. 830-831. The guide explicitly states, "For each security chain, you must configure a dedicated pair of Layer 2 interfaces..." and "For each security chain, you must configure a unique Decryption policy rule that forwards traffic to that chain."

2. Palo Alto Networks TechDocs. "Decryption Broker". This documentation outlines the prerequisites for decryption broker, specifying the need for dedicated interfaces and unique policy rules per security chain in a transparent bridge deployment.