PCNSA App-ID and Content-ID Practice Test 2 — 15 Questions

Question 1

A security engineer wants to block downloading of executable files over HTTP and HTTPS, but allow all other web traffic. Which Content-ID feature should be configured to achieve this granular control?

Accepted Answer

Set up a File Blocking Profile and apply it to the security rule for web-browsing.. A File Blocking Profile is specifically designed to block the transfer of files based on file type (e.g., PE executables) over any allowed application, such as web-browsing. By applying this profile to a security rule that permits HTTP and HTTPS traffic, you can block executable downloads while allowing all other web content. This leverages Content-ID's file-type identification, which inspects the actual file content (magic bytes) rather than relying on extensions or application signatures.

Answer

Use an Application Override to identify executables.

Answer

Create a Data Filtering Profile to block executable file types.

Answer

Configure a URL Filtering Profile to block executables.

Question 2

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

Accepted Answer

Application object for Microsoft Teams.. The security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Answer

Application Filter with conditions matching Microsoft Teams.

Answer

Service object for Microsoft Teams' ports.

Answer

Application Group named 'Chat_Apps' containing all chat apps.

Question 3

A user reports that they cannot download PDF files from a corporate web application. The security policy has a File Blocking Profile applied to deny 'PDF' files. The web application uses 'ssl' and 'web-browsing' apps. What should the administrator verify first?

Accepted Answer

Confirm that the File Blocking Profile is applied to the correct applications (ssl and web-browsing) in the security rule.. File Blocking Profiles are applied per application in a security rule. The administrator must first verify that the profile is attached to the correct applications (ssl and web-browsing) that the web application uses; otherwise, the file blocking will not be enforced for those applications, even if the profile itself is configured correctly.

Answer

Ensure the security rule includes the application 'pdf-download' in the Application list.

Answer

Check that the File Blocking Profile has 'PDF' selected under 'File Types to Block'.

Answer

Verify the URL Category of the web application is included in the rule.

Question 4

A Palo Alto Networks firewall is configured with a security rule that allows 'web-browsing' and has a URL Filtering Profile to block 'malware' sites. However, users can still access known malware URLs. What is the most likely cause?

Accepted Answer

The URL Filtering Profile is not applied to the correct security rule.. The most likely cause is that the URL Filtering Profile is not applied to the correct security rule. Even if a security rule allows 'web-browsing' and a URL Filtering Profile is configured to block 'malware' sites, the profile must be explicitly attached to that rule in the 'Actions' tab under 'Profile Group' or 'URL Filtering Profile'. If it is applied to a different rule or not applied at all, the firewall will not enforce the URL filtering action, allowing access to known malware URLs.

Answer

The 'malware' URL Category is not added to the security rule's URL Category list.

Answer

The 'web-browsing' application is not being identified correctly by App-ID.

Answer

SSL Decryption is not enabled, so the firewall cannot inspect HTTPS URLs.

Question 5

Refer to the exhibit. A user on the Trust zone is trying to download a file from an FTP server on the Untrust zone using FTP on TCP port 21. The firewall's security policy is as shown. What will happen?

Accepted Answer

The traffic is denied by the 'Block-FTP' rule.. The security policy explicitly includes a rule named 'Block-FTP' that denies FTP traffic. FTP uses TCP port 21 for control traffic, and the firewall matches this traffic against the policy rules in order. Since 'Block-FTP' matches the FTP application (or port 21) and denies it, the traffic is blocked before reaching any implicit deny rule.

Answer

The traffic is denied by the implicit deny rule at the end.

Answer

The traffic is allowed because 'Allow-Web' matches web-browsing over port 80 or 443.

Answer

The traffic is allowed because no rule explicitly blocks it.

Question 6

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. The application uses a proprietary protocol on TCP port 8080. What is the most efficient way to ensure correct identification without disabling App-ID?

Accepted Answer

Create a custom App-ID signature for the proprietary protocol.. Creating a custom App-ID signature allows the firewall to correctly identify the proprietary protocol by its unique traffic patterns, such as packet payload signatures or behavioral characteristics, without disabling App-ID. This is the most efficient method as it leverages App-ID's existing classification engine to distinguish the custom application from web-browsing, even though it uses TCP port 8080.

Answer

Use Application Override with the custom application and specify port 8080.

Answer

Disable App-ID for that security rule to allow all traffic on port 8080.

Answer

Create a custom service object for TCP 8080 and add it to a security policy.

Question 7

A company wants to block all traffic from the application 'facebook-base' but allow 'facebook-chat'. Which type of security rule is most appropriate?

Accepted Answer

Application filter in security policy. An Application filter in a security policy allows you to specify which applications are allowed or denied based on the App-ID. By creating a rule that denies 'facebook-base' while allowing 'facebook-chat', you can precisely control traffic at the application layer, even when both applications share the same underlying protocol (e.g., TCP/443). This granularity is a core feature of App-ID, enabling you to block the broader Facebook base application while permitting the specific chat sub-application.

Answer

File Blocking profile

Answer

URL Filtering profile

Answer

Security rule with 'facebook-base' as deny and 'facebook-chat' as allow

Question 8

A network administrator observes that a user is able to access a cloud storage application even though a security rule explicitly blocks that application. Other application blocks work correctly. What is the most likely cause?

Accepted Answer

The user is accessing the application over HTTPS on a common web port, and App-ID cannot correctly identify the application.. App-ID relies on multiple identification mechanisms, including protocol decoding, application signatures, and SSL decryption. When a cloud storage application is accessed over HTTPS on a common web port (e.g., 443), App-ID may fail to correctly identify the application if the traffic is encrypted and no SSL decryption policy is applied, or if the application uses a technique like 'port hopping' or 'tunneling over HTTP/HTTPS'. This causes the security rule explicitly blocking the application to be ineffective, as the traffic is instead matched against a different application signature (e.g., 'web-browsing') that is allowed.

Answer

The security rule order is incorrect; a previous rule allows the application.

Answer

URL filtering is misconfigured and allowing the URL for the cloud storage.

Answer

A Content-ID profile is overriding the application block.

Question 9

During a security audit, it is discovered that some users are bypassing the company's web proxy by using HTTPS to external websites. The firewall is configured to allow 'web-browsing' application. What is the best way to enforce proxy usage for all HTTP/HTTPS traffic?

Accepted Answer

Create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing.. The best way to enforce proxy usage is to create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing. This forces all HTTP/HTTPS traffic through the proxy, as direct web browsing is blocked. The proxy server then applies its own policies.

Answer

Enable SSL decryption and block traffic that is not decrypted.

Answer

Configure Content-ID to block all web traffic.

Answer

Use URL filtering to block all URLs except those from the proxy.

Question 10

Which THREE actions are valid when configuring App-ID in a security policy? (Choose three.)

Accepted Answer

Reset-Client. In a Palo Alto Networks security policy, the App-ID based action field determines how matching application traffic is handled, and the valid actions are Allow, Deny, and Reset-Client. Option B (Deny) is correct because it silently drops the session without notifying the client, which is a standard policy action for blocking identified applications. Option D (Allow) is correct because it permits the identified application traffic to pass and is the primary action used for authorized applications. Option A (Reset-Client) is correct because it sends a TCP RST to the client, actively terminating the session for the matched App-ID. Option C (Apply) is not a security policy action; it is not selectable in the Action column of the policy rule. Option E (Decrypt) is not a policy action either; decryption is configured through Decryption policies and profiles, not as an action in a security policy rule.

Answer

Apply

Answer

Decrypt

Question 11

A financial services company uses a Palo Alto Networks firewall to protect its customer data. They have a requirement to block all file transfers that contain credit card numbers (PCI compliance). The firewall has Data Filtering profiles configured to detect credit card patterns. However, the security team notices that some file transfers containing credit card numbers are not being blocked. The traffic logs show the applications are identified correctly, and the security rule has the Data Filtering profile attached. The Data Filtering profile is configured with a rule to block 'Credit Card Numbers' with a threshold of 1. What could be the issue?

Accepted Answer

The Data Filtering profile does not include the specific applications that are transferring files.. Data Filtering profiles are applied per application. If the specific applications used for file transfers (e.g., custom or less common apps) are not selected within the Data Filtering profile, the firewall will not inspect those transfers for credit card numbers, even if the security rule has the profile attached. The profile must explicitly include the applications to enforce the data filtering rules.

Answer

The Data Filtering profile is not attached to the security rule.

Answer

The security rule is not logging the Data Filtering alerts.

Answer

SSL decryption is not enabled for the traffic.

Question 12

A network security engineer at a large enterprise is troubleshooting an issue where web traffic (HTTP and HTTPS) from the corporate LAN to the internet is being incorrectly classified by the Palo Alto Networks firewall. The firewall is running PAN-OS 10.2. The security policy has an App-ID based rule that allows 'web-browsing' and 'ssl' applications to the internet. However, legitimate web traffic is being blocked by a different rule that denies 'unknown-tcp' traffic. The engineer has verified that the firewall has internet connectivity and that the SSL decryption is not configured. The engineer also confirmed that the application override is not configured for any of the affected IPs. What is the most likely reason for the misclassification, and what action should the engineer take to resolve the issue?

Accepted Answer

Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.. The firewall's App-ID relies on decoding the initial packets of a session to identify the application. Without SSL decryption, HTTPS traffic appears as encrypted payload, which App-ID cannot decode, often resulting in classification as 'ssl' (if the handshake is recognized) or 'unknown-tcp' if the handshake is incomplete or not fully parsed. The engineer should review the App-ID logs for 'incomplete' or 'not-applicable' status, and enabling SSL decryption or updating the certificate chain would allow the firewall to inspect the encrypted traffic and correctly identify it as 'web-browsing' or 'ssl'.

Answer

Configure User-ID and enable User-ID mapping for the web traffic.

Answer

Disable all application security profiles for the affected traffic to allow the firewall to classify based on port only.

Answer

Create custom App-ID signatures for the web servers.

Question 13

A security administrator needs to ensure that users cannot upload files containing confidential data to personal webmail accounts. The administrator has already created a Data Filtering profile that detects the sensitive patterns and attached it to a Security policy rule that allows webmail. Which additional configuration is required on that same Security policy rule for the Data Filtering profile to block the uploads?

Accepted Answer

Enable the Data Filtering profile in the rule's Actions tab and set the profile action to block.. Data Filtering profiles must be attached to a Security policy rule and configured with a block action to enforce content-based restrictions. The rule itself allows the webmail application, and the profile inspects the allowed session for sensitive data patterns. When a match is found, the profile blocks the upload. This provides selective enforcement without denying all webmail traffic.

Answer

Apply a URL Filtering profile with a block action for webmail categories.

Answer

Set the rule action to deny and enable logging at session end.

Answer

Attach a File Blocking profile that blocks all file types.

Question 14

A security administrator has configured a File Blocking profile to block downloads of executable files. Users report that they can still download .exe files from a web application that uses HTTP. The administrator verifies that the security policy has the File Blocking profile applied to the correct rule. What is the most likely reason the files are not being blocked?

Accepted Answer

The File Blocking profile is not applied to the correct direction.. File Blocking profiles have distinct download and upload settings for each file type. If the administrator only configured the upload direction to block executables, downloads would not be blocked. The most likely reason is that the profile's download direction for executables is not set to block, or the profile is not applied to the correct traffic direction.

Answer

The file is being downloaded over HTTPS, not HTTP.

Answer

The firewall does not support file blocking for HTTP traffic.

Answer

The File Blocking profile is set to alert instead of block.

Question 15

A security administrator wants to block downloads of executable files from web browsing sessions while allowing all other file types. The company uses a Palo Alto Networks firewall with a File Blocking profile applied to the security rule that permits web-browsing. Which action should the administrator configure in the File Blocking profile to meet this requirement?

Accepted Answer

Set the action for the 'PE' file type to 'block'.. To block executable downloads, the File Blocking profile must be configured to block the 'PE' file type, which encompasses Windows executables and DLLs. This action specifically targets the desired file category while allowing other file types to be downloaded, satisfying the requirement without unnecessary restrictions.

Answer

Set the action for the 'any' file type to 'block'.

Answer

Set the action for the 'exe' file type to 'alert'.

Answer

Set the action for the 'flash' file type to 'block'.