PCNSA App-ID and Content-ID Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An administrator wants to block all traffic that does not match a specific application (e.g., only allow 'web-browsing'). What should be done?

Accepted Answer

Change action to 'deny' and create a new rule with application ['web-browsing'] above it.. To enforce an allow-list approach for a specific application like 'web-browsing', you must first create a rule that denies all traffic (action 'deny') and then place a higher-priority rule above it that explicitly allows only 'web-browsing'. This ensures that any traffic not matching the allowed application is blocked by the default-deny rule, leveraging App-ID's ability to identify applications regardless of port or protocol.

Answer

Use a file blocking profile.

Answer

Change application to ['unknown-tcp', 'unknown-udp'].

Answer

Change category to ['misccategory'].

Question 2

A network administrator notices that traffic for a custom business application is being incorrectly identified as 'ssl' by the firewall. What is the most efficient way to ensure this application is accurately identified without impacting other SSL traffic?

Accepted Answer

Create an App-ID override for the application's specific IP addresses and ports.. An App-ID override allows you to manually assign a specific application signature to traffic matching defined IP addresses and ports, ensuring the custom business application is correctly identified without altering the global App-ID database or affecting other SSL traffic. This is the most efficient method as it directly overrides the incorrect identification at the application level, preserving the integrity of other SSL-based application detection.

Answer

Disable App-ID for the security policy rule that allows this traffic.

Answer

Upgrade the App-ID database to the latest version.

Answer

Add the application's TCP port to the service definition in the security policy.

Question 3

A security engineer wants to block downloading of executable files over HTTP and HTTPS, but allow all other web traffic. Which Content-ID feature should be configured to achieve this granular control?

Accepted Answer

Set up a File Blocking Profile and apply it to the security rule for web-browsing.. A File Blocking Profile is specifically designed to block the transfer of files based on file type (e.g., PE executables) over any allowed application, such as web-browsing. By applying this profile to a security rule that permits HTTP and HTTPS traffic, you can block executable downloads while allowing all other web content. This leverages Content-ID's file-type identification, which inspects the actual file content (magic bytes) rather than relying on extensions or application signatures.

Answer

Use an Application Override to identify executables.

Answer

Create a Data Filtering Profile to block executable file types.

Answer

Configure a URL Filtering Profile to block executables.

Question 4

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

Accepted Answer

Application object for Microsoft Teams.. The security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Answer

Application Filter with conditions matching Microsoft Teams.

Answer

Service object for Microsoft Teams' ports.

Answer

Application Group named 'Chat_Apps' containing all chat apps.

Question 5

During a security audit, it is discovered that FTP traffic over non-standard ports is bypassing App-ID inspection. What is the most effective method to ensure all FTP traffic is identified, regardless of port?

Accepted Answer

Create an Application Override rule for FTP on the required source and destination addresses.. The most effective method is to create an Application Override rule for FTP, which forces App-ID to identify traffic as FTP based on source/destination addresses, regardless of port. Option A is wrong because updating databases does not change detection on non-standard ports; App-ID relies on port-based signatures unless overridden. Option B is wrong because disabling App-ID removes all application inspection. Option C is wrong because adding a non-standard port to the FTP service definition does not automatically enable App-ID identification; service definitions are used for policy enforcement, not for application identification. Option D is correct because an Application Override rule explicitly tells the firewall to treat traffic that matches the source and destination addresses as the specified application, bypassing port-based detection.

Answer

Update the App-ID and threat databases to the latest version.

Answer

Set the security policy to 'allow' without App-ID to ensure FTP works.

Answer

Add the non-standard port to the FTP service definition.

Question 6

A user reports that they cannot download PDF files from a corporate web application. The security policy has a File Blocking Profile applied to deny 'PDF' files. The web application uses 'ssl' and 'web-browsing' apps. What should the administrator verify first?

Accepted Answer

Confirm that the File Blocking Profile is applied to the correct applications (ssl and web-browsing) in the security rule.. File Blocking Profiles are applied per application in a security rule. The administrator must first verify that the profile is attached to the correct applications (ssl and web-browsing) that the web application uses; otherwise, the file blocking will not be enforced for those applications, even if the profile itself is configured correctly.

Answer

Ensure the security rule includes the application 'pdf-download' in the Application list.

Answer

Check that the File Blocking Profile has 'PDF' selected under 'File Types to Block'.

Answer

Verify the URL Category of the web application is included in the rule.

Question 7

What is the primary benefit of using App-ID in a security policy instead of relying solely on port-based rules?

Accepted Answer

It allows enforcement based on application identity, even if the application uses non-standard ports.. App-ID identifies the actual application regardless of port, allowing enforcement based on application identity even when applications use non-standard ports or camouflage as other traffic. Option A is incorrect because App-ID can have a minor performance impact, not increase throughput. Option C is incorrect because while App-ID can help reduce reliance on port-based rules, the primary benefit is application identification, not rule count reduction. Option D is incorrect because App-ID identifies many applications, not just HTTP/HTTPS.

Answer

It increases firewall throughput.

Answer

It reduces the number of security rules needed.

Answer

It limits traffic to HTTP and HTTPS only.

Question 8

A Palo Alto Networks firewall is configured with a security rule that allows 'web-browsing' and has a URL Filtering Profile to block 'malware' sites. However, users can still access known malware URLs. What is the most likely cause?

Accepted Answer

The URL Filtering Profile is not applied to the correct security rule.. The most likely cause is that the URL Filtering Profile is not applied to the correct security rule. Even if a security rule allows 'web-browsing' and a URL Filtering Profile is configured to block 'malware' sites, the profile must be explicitly attached to that rule in the 'Actions' tab under 'Profile Group' or 'URL Filtering Profile'. If it is applied to a different rule or not applied at all, the firewall will not enforce the URL filtering action, allowing access to known malware URLs.

Answer

The 'malware' URL Category is not added to the security rule's URL Category list.

Answer

The 'web-browsing' application is not being identified correctly by App-ID.

Answer

SSL Decryption is not enabled, so the firewall cannot inspect HTTPS URLs.

Question 9

An administrator wants to block all peer-to-peer file sharing traffic, but must ensure that legitimate business applications like FTP are not affected. Which approach is most effective?

Accepted Answer

Create an Application Filter that matches all P2P applications and use it in a deny rule.. Palo Alto Networks App-ID can identify peer-to-peer (P2P) traffic by application signature, regardless of port. Creating an Application Filter that matches all P2P applications (e.g., BitTorrent, eDonkey, Gnutella) and applying it in a deny rule ensures all P2P traffic is blocked while legitimate business applications like FTP (which uses distinct App-ID signatures) are not affected, as App-ID decodes traffic at Layer 7.

Answer

Create a security rule with 'application none' and block the common P2P ports.

Answer

Use a Service object to block all ports typically used by P2P applications.

Answer

Identify each known P2P application and add them individually to a block rule.

Question 10

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

Accepted Answer

Data Filtering Profile. Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Answer

URL Filtering Profile

Answer

Application Override

Answer

File Blocking Profile

Question 11

Which TWO statements about App-ID are correct? (Choose two.)

Accepted Answer

App-ID can identify applications even if they use standard ports for other services.. App-ID uses multiple identification mechanisms—including application signatures, SSL/TLS fingerprinting, and behavioral analysis—to identify applications regardless of the port they use. This means an application like SSH running on TCP 443 (typically used for HTTPS) will still be correctly identified as SSH, not as web-browsing traffic.

Answer

App-ID is only effective for well-known commercial applications.

Answer

App-ID primarily identifies applications based on port numbers.

Answer

App-ID requires at least 10 packets to identify an application.

Question 12

Which THREE are valid components of Content-ID? (Choose three.)

Accepted Answer

URL Filtering. Content-ID includes URL Filtering, File Blocking, and Data Filtering. Application Filters and Application Override are components of App-ID, not Content-ID. Therefore, the correct answers are C, D, and E.

Answer

Application Filters

Answer

Application Override

Question 13

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Create a security rule with the application and action 'deny'.. App-ID identifies traffic based on application signatures, not just ports. By creating a security rule with the specific application and setting the action to 'deny', the firewall blocks all traffic matching that application regardless of the ports or protocols it uses. This is the most precise and effective method to block an application that uses multiple ports.

Answer

Block the common ports used by the application.

Answer

Disable App-ID on the zone to prevent inspection.

Answer

Create a security rule allowing the application but with a limit.

Question 14

Refer to the exhibit. A user on the Trust zone is trying to download a file from an FTP server on the Untrust zone using FTP on TCP port 21. The firewall's security policy is as shown. What will happen?

Accepted Answer

The traffic is denied by the 'Block-FTP' rule.. The security policy explicitly includes a rule named 'Block-FTP' that denies FTP traffic. FTP uses TCP port 21 for control traffic, and the firewall matches this traffic against the policy rules in order. Since 'Block-FTP' matches the FTP application (or port 21) and denies it, the traffic is blocked before reaching any implicit deny rule.

Answer

The traffic is denied by the implicit deny rule at the end.

Answer

The traffic is allowed because 'Allow-Web' matches web-browsing over port 80 or 443.

Answer

The traffic is allowed because no rule explicitly blocks it.

Question 15

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. The application uses a proprietary protocol on TCP port 8080. What is the most efficient way to ensure correct identification without disabling App-ID?

Accepted Answer

Create a custom App-ID signature for the proprietary protocol.. Creating a custom App-ID signature allows the firewall to correctly identify the proprietary protocol by its unique traffic patterns, such as packet payload signatures or behavioral characteristics, without disabling App-ID. This is the most efficient method as it leverages App-ID's existing classification engine to distinguish the custom application from web-browsing, even though it uses TCP port 8080.

Answer

Use Application Override with the custom application and specify port 8080.

Answer

Disable App-ID for that security rule to allow all traffic on port 8080.

Answer

Create a custom service object for TCP 8080 and add it to a security policy.