Which two types of security chains are supported by the Decryption Broker? (Choose two.)

Decryption Broker allows a Palo Alto Networks firewall to decrypt traffic and forward the cleartext version to a series of third-party security tools for inspection, known as a security chain. The interfaces on the firewall that connect to these external tools must operate transparently to avoid altering the traffic flow. Therefore, the supported interface types for building these security chains are virtual wire and Layer 2. These modes pass traffic through the firewall to the inspection device without performing any routing.

B. Transparent bridge is not a distinct interface type on Palo Alto Networks firewalls; the correct term is Layer 2 interface.
C. Layer 3 interfaces perform routing, which would alter the traffic path and is not the intended function of a transparent security chain.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide (Version 11.0). Decryption Broker. In the subsection "Decryption Broker Security Chains," the documentation states: "The interfaces that connect the firewall to the security devices in the chain must be either virtual wire or Layer 2 interfaces."