PCNSA App-ID and Content-ID Practice Test 3 — 15 Questions

Question 1

A network security administrator is troubleshooting why a Security policy rule that allows the application 'ssl' does not permit an internally developed client-server application that uses TLS on TCP port 8443. The administrator confirms the traffic is reaching the firewall and that no decryption is configured. Which App-ID concept explains why the firewall does not identify the custom application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall requires a custom App-ID to identify the proprietary application because no built-in signature matches its unique handshake pattern.. App-ID requires a signature that matches the application's unique traffic characteristics. When a custom application uses a proprietary protocol or a modified TLS handshake that no built-in signature recognizes, the firewall cannot distinguish it from generic 'ssl' or 'unknown-tcp' traffic. Creating a custom App-ID with a specific pattern allows the firewall to identify and enforce policy on that application. Decryption and service objects do not solve the underlying identification gap.

Answer

The firewall identifies the application as 'ssl' because it only inspects the first packet of a session and does not reassemble the TLS handshake.

Answer

The application is not identified because the firewall cannot inspect TLS traffic without SSL decryption enabled on the security policy.

Answer

The security policy must explicitly allow the 'ssl' application with a service object for port 8443, otherwise App-ID falls back to port-based identification.

Question 2

A security administrator has configured a Security policy rule to allow the application 'web-browsing' but wants to block the use of the 'facebook-posting' application. The administrator notices that users can still post to Facebook because the traffic is being identified as 'web-browsing'. Which App-ID concept explains why 'facebook-posting' is not being blocked?

Accepted Answer

App-ID uses a multi-stage identification process where 'web-browsing' is identified first, and the firewall does not re-evaluate the application when the session transitions to 'facebook-posting'.. App-ID uses a multi-stage identification process where an application may initially be identified as 'web-browsing' and later be reclassified as a more specific application like 'facebook-posting'. If the Security policy only allows 'web-browsing' and does not explicitly deny 'facebook-posting', the session may be allowed under the web-browsing rule. To block facebook-posting, the administrator must create a rule that specifically denies that application. The firewall can re-evaluate the application, but the policy must account for the specific application to enforce the block.

Answer

The firewall cannot identify 'facebook-posting' because it requires SSL decryption, which is not enabled.

Answer

App-ID only identifies applications based on the first packet of a session, so if the initial packet is HTTP, it will always be classified as 'web-browsing'.

Answer

The application 'facebook-posting' is a subset of 'web-browsing' and cannot be blocked separately because it is included in the web-browsing signature.

Question 3

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

Accepted Answer

The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.. App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

Answer

The firewall is not connected to the cloud for App-ID updates.

Answer

Decryption is not enabled for Google Drive traffic.

Answer

An application override is configured for Google Drive.

Question 4

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

Accepted Answer

Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.. App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

Answer

Ensure the application uses a standard port.

Answer

Ensure SSL decryption is enabled for the application.

Answer

Check if the application override is applied to the correct rule.

Question 5

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

Accepted Answer

Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.. Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Answer

Use URL Filtering to block BitTorrent.

Answer

Use Data Filtering to block BitTorrent traffic.

Answer

Block the commonly used ports for BitTorrent.

Question 6

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

Accepted Answer

A file blocking profile is blocking the upload.. A file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

Answer

The application 'webapp' is not allowed due to an application override.

Answer

SSL decryption is not enabled.

Answer

App-ID is not identifying the application correctly.

Question 7

What is the primary benefit of using Content-ID in a security policy?

Accepted Answer

It enables threat prevention and file blocking on allowed applications.. Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Answer

It blocks malicious URLs.

Answer

It prioritizes traffic for specific applications.

Answer

It identifies applications regardless of port.

Question 8

Which TWO of the following are true about App-ID? (Choose two.)

Accepted Answer

App-ID identifies applications regardless of port.. Option B is correct because App-ID performs application identification independent of the TCP/UDP port in use, so an application running on a non-standard port is still recognized rather than being assumed from its port number. Option C is correct because App-ID combines multiple identification techniques — application signatures, protocol decoding, and behavioral/heuristic analysis — to accurately classify traffic, including evasive applications. Option A is incorrect because App-ID supports custom application signatures, allowing administrators to define and identify proprietary or internal applications. Option D is incorrect because App-ID is explicitly not limited to standard ports; port-independent identification is a core design goal of App-ID.

Answer

App-ID cannot identify custom applications.

Answer

App-ID can only identify applications on standard ports.

Question 9

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. What is the most likely cause?

Accepted Answer

The custom application uses HTTP but no specific App-ID signature.. When a custom application uses HTTP but lacks a specific App-ID signature, Palo Alto Networks firewalls default to classifying the traffic as web-browsing (HTTP). App-ID relies on a combination of protocol decoders and application signatures; without a custom App-ID signature defined for the application, the firewall cannot distinguish it from generic HTTP traffic.

Answer

The application signature database is outdated.

Answer

App-ID is disabled on the security rule.

Answer

Content-ID is blocking the application.

Question 10

A company wants to block file uploads of PDFs to the internet via HTTP. Which Content-ID profile should be configured?

Accepted Answer

File Blocking Profile. The File Blocking Profile is specifically designed to block file transfers based on file type, such as PDF, over protocols like HTTP. This profile uses Content-ID to inspect the file content and enforce blocking policies for uploads or downloads, making it the appropriate choice to prevent PDF uploads to the internet.

Answer

Vulnerability Protection Profile

Answer

URL Filtering Profile

Answer

Virus Profile

Question 11

Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?

Accepted Answer

Data Filtering. Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.

Answer

URL Filtering

Answer

File Blocking

Answer

WildFire

Question 12

Which of the following is a prerequisite for App-ID to identify applications in encrypted traffic?

Accepted Answer

Enable SSL decryption.. App-ID identifies applications by analyzing traffic patterns, including those in encrypted flows. However, to inspect the content of encrypted traffic (e.g., HTTPS), the firewall must first decrypt it using SSL decryption. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is insufficient for accurate identification of many modern applications that use encryption.

Answer

Configure a custom application signature.

Answer

Ensure the security rule allows the application.

Answer

Enable App-ID on the security rule.

Question 13

A company has a security policy that allows 'ssl' application but does not have SSL decryption enabled. What can App-ID still identify from the encrypted session?

Accepted Answer

The SNI (Server Name Indication).. App-ID can identify the SNI (Server Name Indication) from an encrypted session because the SNI is sent in cleartext during the TLS handshake, before encryption begins. This allows the firewall to determine the destination hostname without decrypting the traffic, enabling policy enforcement based on the application or domain even when SSL decryption is disabled.

Answer

The exact URL being accessed.

Answer

The file type being transferred.

Answer

The client and server IP addresses.

Question 14

A user reports that they are unable to download executable files from the internet. The firewall security rule allows the application. What should the administrator check first?

Accepted Answer

The file blocking profile for the rule.. The user cannot download executable files, which is a specific file type. The file blocking profile is the Content-ID feature that controls file transfer based on type, regardless of the application being allowed. Since the security rule permits the application, the administrator should first check the file blocking profile attached to that rule to see if it blocks 'executable' files.

Answer

The SSL decryption policy.

Answer

The vulnerability protection profile.

Answer

The URL filtering category for 'executables'.

Question 15

An administrator is troubleshooting why an application is being identified as 'incomplete' in the traffic log. What does this indicate?

Accepted Answer

The session was terminated before App-ID could complete.. When App-ID cannot complete its analysis before the session terminates, the traffic log marks the application as 'incomplete'. This typically happens with short-lived sessions or when the firewall receives insufficient data packets to match a signature or decode the protocol. The correct answer is B because App-ID requires multiple packets or a full handshake to definitively identify the application.

Answer

The application is using a non-standard port.

Answer

The firewall could not determine the application.

Answer

The application is unknown to the firewall.