Which two SSH Proxy decryption profile configurations will reduce network attack surface?

AnSSH Proxy decryption profileallowsPalo Alto Networks NGFWsto inspect encryptedSSH trafficand preventexploitationby attackers.

Toreduce the network attack surface, the two best security settings are:

Block Sessions on Certificate Errors (✔️Correct)

Prevents attackers from usingself-signed or fraudulent certificatesto bypass security inspections.

Ensures that SSH connections usevalid and trusted certificatesonly.

Block Sessions with Unsupported Versions (✔️Correct)

Older SSH versions (e.g., SSH-1) arevulnerable to exploits and weak encryption.

Ensures thatonly secure SSH protocols (e.g., SSH-2) are allowed.

A. Allow sessions if resources not available.❌

Incorrect, becausethis weakens security—attackers could exploit times when decryption is unavailable.

B. Allow sessions with unsupported versions.❌

Incorrect, becauseallowing outdated SSH versionsexposes the network toknown vulnerabilities.

Firewall Deployment– SSH Proxy decryption preventsSSH-based malware tunnels.

Security Policies– Enforcesstrict SSH version control and certificate validation.

VPN Configurations– PreventsSSH tunneling inside VPN connections.

Threat Prevention– Protects againstSSH brute-force attacks and exploits.

WildFire Integration– EnsuresSSH-based file transfers are inspected for malware.

Zero Trust Architectures– Prevents unauthorized SSH sessions withstrict security controls.

Why Other Options Are Incorrect?References to Firewall Deployment and Security Features:Thus, the correct answers are:✅C. Block sessions on certificate errors.✅D. Block sessions with unsupported versions.