PCNSA App-ID and Content-ID — 10 Questions

Question 1

A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?

Accepted Answer

The traffic lacks enough signatures to identify the sub-application.. App-ID uses a multi-layered approach to identify applications, including signatures, SSL decryption, and behavioral analysis. When YouTube traffic is classified as 'youtube-base' instead of the more specific 'youtube-streaming', it indicates that the firewall has identified the base application (YouTube) but lacks sufficient signatures or heuristics to differentiate the streaming sub-application. This typically occurs when the traffic does not contain enough distinct patterns (e.g., specific HTTP headers, TLS SNI, or packet sizes) to trigger the sub-application signature.

Answer

The firewall has not received the latest App-ID update.

Answer

SSL decryption is not configured.

Answer

A security rule is blocking the sub-application.

Question 2

An organization uses App-ID to allow 'web-browsing' but notices that some web traffic is being blocked. The traffic is HTTP over port 8080. What is a likely cause?

Accepted Answer

The security rule does not have Application set to 'web-browsing' for that traffic.. If the security rule does not have 'web-browsing' set as the Application, the firewall will not allow HTTP traffic even if the port (8080) is permitted. App-ID identifies the application regardless of port, but the security policy must explicitly allow the application for the traffic to pass. In this case, the traffic is being blocked because the rule either has a different application or no application specified, so the firewall drops it by default.

Answer

The 'web-browsing' application does not include HTTP.

Answer

A custom application must be created for port 8080.

Answer

App-ID cannot identify HTTP over non-standard ports.

Question 3

Which two components are part of Content-ID? (Choose two.)

Accepted Answer

File Blocking. Content-ID is Palo Alto Networks' integrated threat-prevention engine that inspects traffic for threats and unwanted content, and its components include File Blocking (B) and Data Filtering (C). File Blocking (B) is correct because it lets the firewall identify file types traversing the network and block or alert on them based on policy, which is a core Content-ID function. Data Filtering (C) is correct because it detects and controls sensitive data patterns such as credit card or Social Security numbers in transit, another native Content-ID capability. Application Override (A) is not part of Content-ID; it is a policy mechanism that forces specific traffic to be identified as a chosen application on a specified port, bypassing App-ID signature inspection. URL Filtering (D) is a separate security subscription/profile that controls web access by category and reputation, not a Content-ID component.

Answer

Application Override

Answer

URL Filtering

Question 4

Which THREE factors should be considered when troubleshooting App-ID misidentification? (Choose three.)

Accepted Answer

An application override is configured that misidentifies the app.. Option B is correct because an application override policy forces traffic to be identified as a specific application regardless of the actual App-ID signature match, so a misconfigured override directly causes misidentification. Option C is correct because when traffic is encrypted (for example TLS/SSL) and SSL decryption is not enabled, the firewall cannot inspect the payload and may only identify the app based on port or heuristics, leading to incorrect App-ID results. Option D is correct because asymmetric routing means the firewall sees only one direction of the session, so it lacks the full client-to-server and server-to-client context needed for proper App-ID detection and may misclassify the application. Option A is not correct because MTU/packet-size issues relate to fragmentation and connectivity problems, not to the App-ID identification engine's ability to classify an application.

Answer

Packet size exceeds the maximum transmission unit.

Question 5

Which TWO are capabilities of Content-ID? (Choose two.)

Accepted Answer

Blocking files by type (e.g., .exe, .pdf).. Content-ID is the Cisco ASA/Palo Alto-style content inspection feature that combines file blocking and data filtering. Option A is correct because Content-ID can block files by type, matching extensions such as .exe or .pdf, so malicious or unwanted file downloads/uploads are denied. Option D is correct because Content-ID performs data filtering (DLP-style inspection) to prevent sensitive data, such as credit card numbers or confidential patterns, from being transferred. Option B is not a Content-ID capability; identifying an application regardless of port is App-ID (application identification), which is a separate function. Option C is also not Content-ID; applying QoS policies to applications is done by QoS/App-ID-based traffic shaping, not by Content-ID inspection.

Answer

Identifying the application regardless of port.

Answer

Applying QoS policies to applications.

Question 6

What is the most likely reason the traffic is being denied?

Accepted Answer

A threat prevention profile is blocking the application due to its 'evasive-behavior' characteristic.. The question describes a scenario where traffic is denied despite the application being identified by App-ID. A threat prevention profile can block applications that exhibit 'evasive-behavior' characteristics, such as using non-standard ports or encryption to evade detection. This is a common security control in Palo Alto Networks firewalls to prevent malicious or evasive applications from bypassing policy.

Answer

The application is not actually matching the rule.

Answer

A DoS protection policy is blocking the traffic.

Answer

App-ID is incorrectly identifying the traffic.

Question 7

A medium-sized enterprise has deployed a Palo Alto Networks firewall in a branch office. They use App-ID to control access to cloud applications. Recently, they migrated from on-premises Exchange to Office 365. They have a security rule that allows 'office365-base' for all users. However, users report that they cannot access their Office 365 email via Outlook client, although web access works fine. The firewall logs show that the traffic is being allowed as 'office365-base' but no other Office 365 sub-applications are seen. The IT team suspects that App-ID is not fully identifying the Outlook client traffic. What should they do to resolve this issue?

Accepted Answer

Modify the existing rule to allow 'office365-base' and other Office 365 sub-applications like 'office365-outlook' and 'office365-exchange'.. The 'office365-base' App-ID only provides basic identification for Office 365 traffic, but Outlook client traffic requires more specific sub-applications like 'office365-outlook' and 'office365-exchange' to be explicitly allowed in the security rule. Without these sub-applications, the firewall may allow the traffic as 'office365-base' but fail to fully identify and permit the Outlook client's proprietary protocols, such as MAPI over HTTP or RPC over HTTPS, which are necessary for email functionality.

Answer

Enable SSL decryption to allow App-ID to identify the Outlook traffic.

Answer

Create a new rule that allows 'outlook' application specifically.

Answer

Change the rule to allow 'office365-base' and set Action to 'allow' with a QoS policy.

Question 8

A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?

Accepted Answer

The security rule that allows the traffic does not include the custom application.. The security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.

Answer

SSL decryption is not enabled for the custom application.

Answer

The custom application needs to be added to the 'ssl' application group.

Answer

The application override was not committed.

Question 9

Drag and drop the steps to configure a URL filtering profile on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create URL filtering profile, then configure SSL decryption, then apply the profile to a security policy, then test and verify.. URL filtering profile involves categories, actions, policy attachment, SSL decryption, and testing.

Answer

Create URL filtering profile, then apply the profile to a security policy, then configure SSL decryption, then test and verify.

Answer

Configure SSL decryption, then apply the profile to a security policy, then create URL filtering profile, then test and verify.

Answer

Test and verify, then create URL filtering profile, then configure SSL decryption, then apply the profile to a security policy.

Question 10

Match each security zone type to its characteristic.

Accepted Answer

Trust: Network zone for internal trusted users and resources.. In Palo Alto firewalls, typical security zones include Trust (internal), Untrust (external), DMZ (public services), and Management (firewall admin). Common confusions arise from swapping Trust and Untrust or misattributing DMZ characteristics.

Answer

Trust: Zone for publicly accessible servers.

Answer

Untrust: Zone for internal trusted networks.