What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)

What are two common reasons to use a "No Decrypt" action to exclude traffic from SSL decryption? (Choose two.)
A . the website matches a category that is not allowed for most users
B . the website matches a high-risk category
C . the web server requires mutual authentication
D . the website matches a sensitive category

Answer: C,D

Explanation:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-exclusions/palo-alto-networks-predefined-decryption-exclusions.html

The firewall provides a predefined SSL Decryption Exclusion list to exclude from decryption commonly used sites that break decryption because of technical reasons such as pinned certificates and mutual authentication.