Which two steps are required to configure the Decryption Broker? (Choose two.)

Configuring Decryption Broker on a Palo Alto Networks firewall requires two primary steps. First, the feature must be licensed; the firewall needs a specific Decryption Broker license, which must be activated. Second, dedicated interfaces must be configured to forward the decrypted traffic to an external security tool chain and to receive the traffic back. These interfaces are typically configured as a virtual wire pair or as Layer 2 interfaces to ensure transparent inspection without requiring routing changes.

A. A reboot is not a mandatory step for license activation. Licenses can be fetched from the server and installed on a running system.
C. SSL Forward Proxy is a separate decryption mode for outbound traffic and is not a prerequisite for configuring the Decryption Broker functionality itself.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. Configure Decryption Broker. "Before you begin, you must have a Decryption Broker license."

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. Configure Decryption Broker. "Configure a pair of Layer 2 or virtual wire interfaces to forward decrypted traffic to the security chain."

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. Activate Licenses. This section details license activation, which does not mandate a reboot unless specified for a major feature release.