@Kosta sometimes, PCSNE give more right answer and only require less ..maybe they want make it test earlier but make people crazy

Hello,

Block sessions with unsupported versions and cipher suites, and that require using client authentication. (answer C.)

Block sessions based on certificate status, including blocking sessions with expired certificates, untrusted issuers, unknown certificate status, certificate status check timeouts, and certificate extensions. (answer A and D.)

so for this question also C. is correct -but why it considers only A and D correct ?

Reference:
https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/define-traffic-to-decrypt/create-a-decryption-profile