PCNSA App-ID and Content-ID Practice Test 4 — 15 Questions

Question 1

A company wants to block all traffic from the application 'facebook-base' but allow 'facebook-chat'. Which type of security rule is most appropriate?

Accepted Answer

Application filter in security policy. An Application filter in a security policy allows you to specify which applications are allowed or denied based on the App-ID. By creating a rule that denies 'facebook-base' while allowing 'facebook-chat', you can precisely control traffic at the application layer, even when both applications share the same underlying protocol (e.g., TCP/443). This granularity is a core feature of App-ID, enabling you to block the broader Facebook base application while permitting the specific chat sub-application.

Answer

File Blocking profile

Answer

URL Filtering profile

Answer

Security rule with 'facebook-base' as deny and 'facebook-chat' as allow

Question 2

An organization uses a custom ERP system that communicates over TCP port 4444. The firewall's App-ID incorrectly identifies some of the traffic as 'ssl' because the ERP system uses a proprietary encryption wrapper. What is the recommended approach to ensure correct identification?

Accepted Answer

Create a custom App-ID that matches the proprietary encryption wrapper signature.. When App-ID misclassifies traffic due to a proprietary encryption wrapper, the recommended approach is to create a custom App-ID that matches the specific signature of that wrapper. This allows the firewall to correctly identify the application without relying on port-based heuristics or decryption, preserving the integrity of the encrypted session while ensuring accurate policy enforcement.

Answer

Use Application Override to force the ERP application for all traffic on port 4444.

Answer

Enable SSL decryption to inspect the encrypted traffic.

Answer

Add a security rule that allows the ERP application object without further configuration.

Question 3

A network administrator observes that a user is able to access a cloud storage application even though a security rule explicitly blocks that application. Other application blocks work correctly. What is the most likely cause?

Accepted Answer

The user is accessing the application over HTTPS on a common web port, and App-ID cannot correctly identify the application.. App-ID relies on multiple identification mechanisms, including protocol decoding, application signatures, and SSL decryption. When a cloud storage application is accessed over HTTPS on a common web port (e.g., 443), App-ID may fail to correctly identify the application if the traffic is encrypted and no SSL decryption policy is applied, or if the application uses a technique like 'port hopping' or 'tunneling over HTTP/HTTPS'. This causes the security rule explicitly blocking the application to be ineffective, as the traffic is instead matched against a different application signature (e.g., 'web-browsing') that is allowed.

Answer

The security rule order is incorrect; a previous rule allows the application.

Answer

URL filtering is misconfigured and allowing the URL for the cloud storage.

Answer

A Content-ID profile is overriding the application block.

Question 4

Which of the following is a primary benefit of using App-ID in a security policy?

Accepted Answer

It enforces policies based on the actual application, irrespective of port or encryption.. App-ID is a core Palo Alto Networks technology that identifies traffic based on application signatures, not just port or protocol. This allows security policies to enforce rules based on the actual application (e.g., Facebook, Salesforce) even if it uses non-standard ports or is encrypted via SSL/TLS. The primary benefit is decoupling application identification from port, enabling granular control over application usage regardless of how the application is disguised.

Answer

It allows blocking traffic based on port numbers only.

Answer

It only works for known applications.

Answer

It can only be applied to outbound traffic.

Question 5

During a security audit, it is discovered that some users are bypassing the company's web proxy by using HTTPS to external websites. The firewall is configured to allow 'web-browsing' application. What is the best way to enforce proxy usage for all HTTP/HTTPS traffic?

Accepted Answer

Create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing.. By blocking the 'web-browsing' application for regular users and allowing only the proxy server to use it, you enforce that all HTTP/HTTPS traffic must go through the proxy. SSL decryption (A) helps inspect encrypted traffic but does not force proxy usage. Content-ID (C) is not used to block entire categories like web traffic; it focuses on threat signatures. URL filtering (D) can block or allow specific URLs but does not enforce proxy routing; users could still bypass the proxy using different URLs or IP addresses.

Answer

Enable SSL decryption and block traffic that is not decrypted.

Answer

Configure Content-ID to block all web traffic.

Answer

Use URL filtering to block all URLs except those from the proxy.

Question 6

An administrator wants to block upload of files with extension .exe to the application 'box-net'. Which security policy component is most appropriate?

Accepted Answer

File Blocking profile. The File Blocking profile is the correct choice because it is specifically designed to block files based on type (e.g., .exe) within allowed applications like 'box-net'. This profile works with App-ID to enforce content-level control, preventing the upload of executable files while still permitting the application's traffic.

Answer

Data Filtering profile

Answer

Application filter in security rule

Answer

URL Filtering profile

Question 7

Which TWO statements are true regarding App-ID and Content-ID? (Choose two.)

Accepted Answer

Content-ID provides capabilities such as File Blocking, Data Filtering, and URL Filtering.. Options A and B are correct. Option A is true because Content-ID includes File Blocking, Data Filtering, and URL Filtering. Option B is true because App-ID identifies applications regardless of port or protocol. Option C is false because Content-ID works for all traffic, not just web. Option D is false because App-ID can identify encrypted applications without SSL decryption using other methods like TLS fingerprinting. Option E is false because Content-ID depends on App-ID for application context; it cannot function without App-ID enabled.

Answer

Content-ID only works for web traffic.

Answer

App-ID requires SSL decryption to identify encrypted applications.

Answer

Content-ID can function without App-ID enabled.

Question 8

Which THREE actions are valid when configuring App-ID in a security policy? (Choose three.)

Accepted Answer

Reset-Client. A is correct because 'Reset-Client' is a valid action in App-ID security policy rules that terminates the client session by sending a TCP reset (RST) packet. This action is used to block traffic while providing immediate feedback to the client that the connection was refused, rather than silently dropping packets.

Answer

Apply

Answer

Decrypt

Question 9

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Accepted Answer

Pattern matching (signatures). App-ID uses pattern matching (signatures) to identify applications by analyzing the unique byte sequences or payload patterns within network traffic. These signatures are derived from the application's protocol behavior and can detect applications even when they use non-standard ports or encryption.

Answer

URL filtering

Answer

Source port number

Answer

Source IP address

Question 10

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

Accepted Answer

App-ID has not yet completed identification because the session is new or requires more packets.. When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Answer

The security rule is misconfigured because it lacks an application field.

Answer

The firewall does not have an App-ID signature for the website.

Answer

SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

Question 11

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

Accepted Answer

The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.. App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire. Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Answer

The firewall needs to have Application Override enabled for the custom signature to work.

Answer

The firewall must be restarted to apply the new custom signature.

Answer

The signature must be imported from the Palo Alto Networks application database.

Question 12

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

Accepted Answer

The rule is placed after an allow rule that matches the traffic.. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Answer

BitTorrent is not part of the peer-to-peer application category.

Answer

The security rule is using an application group instead of an application filter.

Answer

The firewall does not have the latest App-ID update and cannot identify BitTorrent.

Question 13

A small business owner wants to block all social media applications during work hours for employees. The firewall is configured with App-ID and has a security rule that denies the 'social-networking' application category from the internal zone to the internet zone. However, employees are still able to access Facebook and Twitter. The traffic logs show these applications are being allowed by a different rule. The administrator checks the security policy and finds the deny rule for social-networking is present but not matched. What is the most likely reason the deny rule is not being matched?

Accepted Answer

There is a rule above the deny rule that allows all traffic.. The most likely reason the deny rule is not matched is that a higher-priority rule (placed above the deny rule) is allowing all traffic, including social networking. In Palo Alto firewalls, security rules are evaluated from top to bottom; the first matching rule is applied. Even if a deny rule exists for social-networking, if a preceding rule allows all traffic, the deny rule is never evaluated. The traffic logs indicate that the applications are allowed by a different rule, which supports this explanation.

Answer

The source IP address range does not include the employees' subnet.

Answer

The source zone is set to 'any' but the actual traffic is coming from a different zone than assumed.

Answer

The security rule does not have a URL Filtering profile attached.

Question 14

A financial services company uses a Palo Alto Networks firewall to protect its customer data. They have a requirement to block all file transfers that contain credit card numbers (PCI compliance). The firewall has Data Filtering profiles configured to detect credit card patterns. However, the security team notices that some file transfers containing credit card numbers are not being blocked. The traffic logs show the applications are identified correctly, and the security rule has the Data Filtering profile attached. The Data Filtering profile is configured with a rule to block 'Credit Card Numbers' with a threshold of 1. What could be the issue?

Accepted Answer

The Data Filtering profile does not include the specific applications that are transferring files.. Data Filtering profiles are applied per application. If the specific applications used for file transfers (e.g., custom or less common apps) are not selected within the Data Filtering profile, the firewall will not inspect those transfers for credit card numbers, even if the security rule has the profile attached. The profile must explicitly include the applications to enforce the data filtering rules.

Answer

The Data Filtering profile is not attached to the security rule.

Answer

The security rule is not logging the Data Filtering alerts.

Answer

SSL decryption is not enabled for the traffic.

Question 15

A network security engineer at a large enterprise is troubleshooting an issue where web traffic (HTTP and HTTPS) from the corporate LAN to the internet is being incorrectly classified by the Palo Alto Networks firewall. The firewall is running PAN-OS 10.2. The security policy has an App-ID based rule that allows 'web-browsing' and 'ssl' applications to the internet. However, legitimate web traffic is being blocked by a different rule that denies 'unknown-tcp' traffic. The engineer has verified that the firewall has internet connectivity and that the SSL decryption is not configured. The engineer also confirmed that the application override is not configured for any of the affected IPs. What is the most likely reason for the misclassification, and what action should the engineer take to resolve the issue?

Accepted Answer

Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.. The firewall's App-ID relies on decoding the initial packets of a session to identify the application. Without SSL decryption, HTTPS traffic appears as encrypted payload, which App-ID cannot decode, often resulting in classification as 'ssl' (if the handshake is recognized) or 'unknown-tcp' if the handshake is incomplete or not fully parsed. The engineer should review the App-ID logs for 'incomplete' or 'not-applicable' status, and enabling SSL decryption or updating the certificate chain would allow the firewall to inspect the encrypted traffic and correctly identify it as 'web-browsing' or 'ssl'.

Answer

Configure User-ID and enable User-ID mapping for the web traffic.

Answer

Disable all application security profiles for the affected traffic to allow the firewall to classify based on port only.

Answer

Create custom App-ID signatures for the web servers.