AnSSH Proxy decryption profileallowsPalo Alto Networks NGFWsto inspect encryptedSSH trafficand preventexploitationby attackers.

Toreduce the network attack surface, the two best security settings are:

Block Sessions on Certificate Errors (✔️Correct)

Prevents attackers from usingself-signed or fraudulent certificatesto bypass security inspections.

Ensures that SSH connections usevalid and trusted certificatesonly.

Block Sessions with Unsupported Versions (✔️Correct)

Older SSH versions (e.g., SSH-1) arevulnerable to exploits and weak encryption.

Ensures thatonly secure SSH protocols (e.g., SSH-2) are allowed.

A. Allow sessions if resources not available.❌

Incorrect, becausethis weakens security—attackers could exploit times when decryption is unavailable.

B. Allow sessions with unsupported versions.❌

Incorrect, becauseallowing outdated SSH versionsexposes the network toknown vulnerabilities.

Firewall Deployment– SSH Proxy decryption preventsSSH-based malware tunnels.

Security Policies– Enforcesstrict SSH version control and certificate validation.

VPN Configurations– PreventsSSH tunneling inside VPN connections.

Threat Prevention– Protects againstSSH brute-force attacks and exploits.

WildFire Integration– EnsuresSSH-based file transfers are inspected for malware.

Zero Trust Architectures– Prevents unauthorized SSH sessions withstrict security controls.

Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:✅C. Block sessions on certificate errors.✅D. Block sessions with unsupported versions.