Which two of the following does decryption broker provide on a NGFW? (Choose two.)

Decryption Broker on a Palo Alto Networks NGFW centralizes SSL/TLS decryption. This allows the firewall to decrypt traffic once and then forward the cleartext traffic to a chain of third-party security devices (like DLP or IDS) for inspection. This "decrypt once, inspect many times" model is highly efficient. A primary architectural benefit is the consolidation of the decryption function onto the NGFW, which eliminates the need for separate, dedicated third-party decryption appliances, thereby simplifying the security architecture and reducing latency.

C. The NGFW acts as the central, first-party decryption point in this architecture, not as a third-party option.
D. This is incorrect. The core principle of Decryption Broker is to "decrypt once" for efficiency, not multiple times, which would be redundant and resource-intensive.

1. Palo Alto Networks. (n.d.). PAN-OS® Administrator’s Guide: Decryption Broker. Palo Alto Networks Documentation. In the "Decryption Broker" section, the guide states, "This is a 'decrypt once and inspect many times' model that gives you the flexibility to integrate various security solutions into your network." This directly supports option A and refutes option D.

2. Palo Alto Networks. (2021). Datasheet: Decryption. This document states, "This approach eliminates the need for dedicated decryption devices and reduces the number of devices performing decryption, which simplifies network design and reduces latency." This directly supports the primary benefit described in option B.