PCNSA App-ID and Content-ID — 30 Questions

Question 1

A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?

Accepted Answer

The traffic lacks enough signatures to identify the sub-application.. App-ID uses a multi-layered approach to identify applications, including signatures, SSL decryption, and behavioral analysis. When YouTube traffic is classified as 'youtube-base' instead of the more specific 'youtube-streaming', it indicates that the firewall has identified the base application (YouTube) but lacks sufficient signatures or heuristics to differentiate the streaming sub-application. This typically occurs when the traffic does not contain enough distinct patterns (e.g., specific HTTP headers, TLS SNI, or packet sizes) to trigger the sub-application signature.

Answer

The firewall has not received the latest App-ID update.

Answer

SSL decryption is not configured.

Answer

A security rule is blocking the sub-application.

Question 2

An organization uses App-ID to allow 'web-browsing' but notices that some web traffic is being blocked. The traffic is HTTP over port 8080. What is a likely cause?

Accepted Answer

The security rule does not have Application set to 'web-browsing' for that traffic.. If the security rule does not have 'web-browsing' set as the Application, the firewall will not allow HTTP traffic even if the port (8080) is permitted. App-ID identifies the application regardless of port, but the security policy must explicitly allow the application for the traffic to pass. In this case, the traffic is being blocked because the rule either has a different application or no application specified, so the firewall drops it by default.

Answer

The 'web-browsing' application does not include HTTP.

Answer

A custom application must be created for port 8080.

Answer

App-ID cannot identify HTTP over non-standard ports.

Question 3

Which two components are part of Content-ID? (Choose two.)

Accepted Answer

File Blocking. Content-ID is Palo Alto Networks' integrated threat-prevention engine that inspects traffic for threats and unwanted content, and its components include File Blocking (B) and Data Filtering (C). File Blocking (B) is correct because it lets the firewall identify file types traversing the network and block or alert on them based on policy, which is a core Content-ID function. Data Filtering (C) is correct because it detects and controls sensitive data patterns such as credit card or Social Security numbers in transit, another native Content-ID capability. Application Override (A) is not part of Content-ID; it is a policy mechanism that forces specific traffic to be identified as a chosen application on a specified port, bypassing App-ID signature inspection. URL Filtering (D) is a separate security subscription/profile that controls web access by category and reputation, not a Content-ID component.

Answer

Application Override

Answer

URL Filtering

Question 4

Which THREE factors should be considered when troubleshooting App-ID misidentification? (Choose three.)

Accepted Answer

An application override is configured that misidentifies the app.. Option B is correct because an application override policy forces traffic to be identified as a specific application regardless of the actual App-ID signature match, so a misconfigured override directly causes misidentification. Option C is correct because when traffic is encrypted (for example TLS/SSL) and SSL decryption is not enabled, the firewall cannot inspect the payload and may only identify the app based on port or heuristics, leading to incorrect App-ID results. Option D is correct because asymmetric routing means the firewall sees only one direction of the session, so it lacks the full client-to-server and server-to-client context needed for proper App-ID detection and may misclassify the application. Option A is not correct because MTU/packet-size issues relate to fragmentation and connectivity problems, not to the App-ID identification engine's ability to classify an application.

Answer

Packet size exceeds the maximum transmission unit.

Question 5

Which TWO are capabilities of Content-ID? (Choose two.)

Accepted Answer

Blocking files by type (e.g., .exe, .pdf).. Content-ID is the Cisco ASA/Palo Alto-style content inspection feature that combines file blocking and data filtering. Option A is correct because Content-ID can block files by type, matching extensions such as .exe or .pdf, so malicious or unwanted file downloads/uploads are denied. Option D is correct because Content-ID performs data filtering (DLP-style inspection) to prevent sensitive data, such as credit card numbers or confidential patterns, from being transferred. Option B is not a Content-ID capability; identifying an application regardless of port is App-ID (application identification), which is a separate function. Option C is also not Content-ID; applying QoS policies to applications is done by QoS/App-ID-based traffic shaping, not by Content-ID inspection.

Answer

Identifying the application regardless of port.

Answer

Applying QoS policies to applications.

Question 6

What is the most likely reason the traffic is being denied?

Accepted Answer

A threat prevention profile is blocking the application due to its 'evasive-behavior' characteristic.. The question describes a scenario where traffic is denied despite the application being identified by App-ID. A threat prevention profile can block applications that exhibit 'evasive-behavior' characteristics, such as using non-standard ports or encryption to evade detection. This is a common security control in Palo Alto Networks firewalls to prevent malicious or evasive applications from bypassing policy.

Answer

The application is not actually matching the rule.

Answer

A DoS protection policy is blocking the traffic.

Answer

App-ID is incorrectly identifying the traffic.

Question 7

A medium-sized enterprise has deployed a Palo Alto Networks firewall in a branch office. They use App-ID to control access to cloud applications. Recently, they migrated from on-premises Exchange to Office 365. They have a security rule that allows 'office365-base' for all users. However, users report that they cannot access their Office 365 email via Outlook client, although web access works fine. The firewall logs show that the traffic is being allowed as 'office365-base' but no other Office 365 sub-applications are seen. The IT team suspects that App-ID is not fully identifying the Outlook client traffic. What should they do to resolve this issue?

Accepted Answer

Modify the existing rule to allow 'office365-base' and other Office 365 sub-applications like 'office365-outlook' and 'office365-exchange'.. The 'office365-base' App-ID only provides basic identification for Office 365 traffic, but Outlook client traffic requires more specific sub-applications like 'office365-outlook' and 'office365-exchange' to be explicitly allowed in the security rule. Without these sub-applications, the firewall may allow the traffic as 'office365-base' but fail to fully identify and permit the Outlook client's proprietary protocols, such as MAPI over HTTP or RPC over HTTPS, which are necessary for email functionality.

Answer

Enable SSL decryption to allow App-ID to identify the Outlook traffic.

Answer

Create a new rule that allows 'outlook' application specifically.

Answer

Change the rule to allow 'office365-base' and set Action to 'allow' with a QoS policy.

Question 8

A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?

Accepted Answer

The security rule that allows the traffic does not include the custom application.. The security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.

Answer

SSL decryption is not enabled for the custom application.

Answer

The custom application needs to be added to the 'ssl' application group.

Answer

The application override was not committed.

Question 9

Drag and drop the steps to configure a URL filtering profile on a Palo Alto Networks firewall into the correct order.

Accepted Answer

Create URL filtering profile, then configure SSL decryption, then apply the profile to a security policy, then test and verify.. URL filtering profile involves categories, actions, policy attachment, SSL decryption, and testing.

Answer

Create URL filtering profile, then apply the profile to a security policy, then configure SSL decryption, then test and verify.

Answer

Configure SSL decryption, then apply the profile to a security policy, then create URL filtering profile, then test and verify.

Answer

Test and verify, then create URL filtering profile, then configure SSL decryption, then apply the profile to a security policy.

Question 10

Match each security zone type to its characteristic.

Accepted Answer

Trust: Network zone for internal trusted users and resources.. In Palo Alto firewalls, typical security zones include Trust (internal), Untrust (external), DMZ (public services), and Management (firewall admin). Common confusions arise from swapping Trust and Untrust or misattributing DMZ characteristics.

Answer

Trust: Zone for publicly accessible servers.

Answer

Untrust: Zone for internal trusted networks.

Question 11

Which TWO methods can be used to create a custom App-ID signature?

Accepted Answer

Using a packet buffer override.. Option B is correct because a packet buffer override allows you to capture live traffic and use the captured packet data as the basis for creating a custom App-ID signature in the Palo Alto Networks firewall, enabling signature generation from actual observed sessions. Option D is correct because a custom application signature can be built using an attribute filter, which defines the signature by matching specific application attributes (such as context, direction, and pattern) within the App-ID signature editor. Options A and C are incorrect because Data Filtering and URL Filtering profiles are security enforcement profiles applied to traffic; they do not create or define App-ID signatures. Option E is incorrect because a port match alone is not a valid method for creating a custom App-ID signature, since App-ID is designed to identify applications regardless of port, and port-based matching is not the supported signature-creation mechanism.

Answer

Using a Data Filtering profile.

Answer

Using a URL Filtering profile.

Answer

Using a custom application signature with a port match.

Question 12

Which TWO are required for accurate application identification when an application uses non-standard ports?

Accepted Answer

Enable App-ID.. App-ID is the core technology that identifies applications regardless of port, using signatures, protocol decoders, and behavioral analysis. When an application uses non-standard ports, App-ID must be enabled to inspect traffic beyond simple port-based classification, ensuring accurate identification even if the application is not using its default port.

Answer

Define a custom service for the port.

Answer

Use a Content-ID profile.

Answer

Disable SSL Decryption.

Question 13

Refer to the exhibit. An administrator sees this output and notices that App-ID is not identifying applications. What is the most likely cause?

Accepted Answer

The application database is not yet loaded.. The output shows that App-ID is not identifying applications, which typically occurs when the application database has not finished loading after a reboot or initial startup. During this period, the firewall cannot perform application-based classification, so all traffic is treated as unknown until the database is fully loaded. This is a known behavior in PAN-OS, where the application database loads asynchronously after the system boots.

Answer

The security rules are misconfigured.

Answer

The firewall needs a license for App-ID.

Answer

App-ID is disabled.

Question 14

Refer to the exhibit. An administrator notes that traffic to Facebook is being denied. What is the most likely reason?

Accepted Answer

Facebook is not in the allowed applications list.. The exhibit shows a security policy rule with an 'allowed applications' list that does not include Facebook. Since App-ID identifies Facebook traffic by its application signature, any traffic matching this rule will be denied unless Facebook is explicitly allowed. Option D is correct because the absence of Facebook in the allowed applications list causes the firewall to block the traffic.

Answer

SSL decryption is not configured.

Answer

The profile group is blocking Facebook.

Answer

The rule order is incorrect.

Question 15

Refer to the exhibit. An administrator wants to block all traffic that does not match a specific application (e.g., only allow 'web-browsing'). What should be done?

Accepted Answer

Change action to 'deny' and create a new rule with application ['web-browsing'] above it.. To enforce an allow-list approach for a specific application like 'web-browsing', you must first create a rule that denies all traffic (action 'deny') and then place a higher-priority rule above it that explicitly allows only 'web-browsing'. This ensures that any traffic not matching the allowed application is blocked by the default-deny rule, leveraging App-ID's ability to identify applications regardless of port or protocol.

Answer

Use a file blocking profile.

Answer

Change application to ['unknown-tcp', 'unknown-udp'].

Answer

Change category to ['misccategory'].

Question 16

A security engineer wants to block downloading of executable files over HTTP and HTTPS, but allow all other web traffic. Which Content-ID feature should be configured to achieve this granular control?

Accepted Answer

Set up a File Blocking Profile and apply it to the security rule for web-browsing.. A File Blocking Profile is specifically designed to block the transfer of files based on file type (e.g., PE executables) over any allowed application, such as web-browsing. By applying this profile to a security rule that permits HTTP and HTTPS traffic, you can block executable downloads while allowing all other web content. This leverages Content-ID's file-type identification, which inspects the actual file content (magic bytes) rather than relying on extensions or application signatures.

Answer

Use an Application Override to identify executables.

Answer

Create a Data Filtering Profile to block executable file types.

Answer

Configure a URL Filtering Profile to block executables.

Question 17

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

Accepted Answer

Application object for Microsoft Teams.. The security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Answer

Application Filter with conditions matching Microsoft Teams.

Answer

Service object for Microsoft Teams' ports.

Answer

Application Group named 'Chat_Apps' containing all chat apps.

Question 18

A user reports that they cannot download PDF files from a corporate web application. The security policy has a File Blocking Profile applied to deny 'PDF' files. The web application uses 'ssl' and 'web-browsing' apps. What should the administrator verify first?

Accepted Answer

Confirm that the File Blocking Profile is applied to the correct applications (ssl and web-browsing) in the security rule.. File Blocking Profiles are applied per application in a security rule. The administrator must first verify that the profile is attached to the correct applications (ssl and web-browsing) that the web application uses; otherwise, the file blocking will not be enforced for those applications, even if the profile itself is configured correctly.

Answer

Ensure the security rule includes the application 'pdf-download' in the Application list.

Answer

Check that the File Blocking Profile has 'PDF' selected under 'File Types to Block'.

Answer

Verify the URL Category of the web application is included in the rule.

Question 19

A Palo Alto Networks firewall is configured with a security rule that allows 'web-browsing' and has a URL Filtering Profile to block 'malware' sites. However, users can still access known malware URLs. What is the most likely cause?

Accepted Answer

The URL Filtering Profile is not applied to the correct security rule.. The most likely cause is that the URL Filtering Profile is not applied to the correct security rule. Even if a security rule allows 'web-browsing' and a URL Filtering Profile is configured to block 'malware' sites, the profile must be explicitly attached to that rule in the 'Actions' tab under 'Profile Group' or 'URL Filtering Profile'. If it is applied to a different rule or not applied at all, the firewall will not enforce the URL filtering action, allowing access to known malware URLs.

Answer

The 'malware' URL Category is not added to the security rule's URL Category list.

Answer

The 'web-browsing' application is not being identified correctly by App-ID.

Answer

SSL Decryption is not enabled, so the firewall cannot inspect HTTPS URLs.

Question 20

Refer to the exhibit. A user on the Trust zone is trying to download a file from an FTP server on the Untrust zone using FTP on TCP port 21. The firewall's security policy is as shown. What will happen?

Accepted Answer

The traffic is denied by the 'Block-FTP' rule.. The security policy explicitly includes a rule named 'Block-FTP' that denies FTP traffic. FTP uses TCP port 21 for control traffic, and the firewall matches this traffic against the policy rules in order. Since 'Block-FTP' matches the FTP application (or port 21) and denies it, the traffic is blocked before reaching any implicit deny rule.

Answer

The traffic is denied by the implicit deny rule at the end.

Answer

The traffic is allowed because 'Allow-Web' matches web-browsing over port 80 or 443.

Answer

The traffic is allowed because no rule explicitly blocks it.