PCNSA App-ID and Content-ID Practice Test 5 — 15 Questions

Question 1

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Accepted Answer

Pattern matching (signatures). App-ID identifies applications primarily through pattern matching (signatures) (D), which inspects packet payloads against a database of application-specific signatures to recognize known applications, and protocol decoding (E), which decodes the application-layer protocol to understand its behavior and enforce policy even when traffic is encrypted or evasive. These two techniques are the core detection mechanisms Palo Alto Networks documents for App-ID, working alongside behavioral heuristics and decryption. URL filtering (A) is a separate security profile that controls web access by category, not an App-ID identification method. Source port number (B) and source IP address (C) are Layer 3/4 header attributes used in traditional firewall rules, not application identification techniques.

Answer

URL filtering

Answer

Source port number

Answer

Source IP address

Question 2

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

Accepted Answer

App-ID has not yet completed identification because the session is new or requires more packets.. When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Answer

The security rule is misconfigured because it lacks an application field.

Answer

The firewall does not have an App-ID signature for the website.

Answer

SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

Question 3

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

Accepted Answer

The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.. App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire. Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Answer

The firewall needs to have Application Override enabled for the custom signature to work.

Answer

The firewall must be restarted to apply the new custom signature.

Answer

The signature must be imported from the Palo Alto Networks application database.

Question 4

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

Accepted Answer

The rule is placed after an allow rule that matches the traffic.. In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Answer

BitTorrent is not part of the peer-to-peer application category.

Answer

The security rule is using an application group instead of an application filter.

Answer

The firewall does not have the latest App-ID update and cannot identify BitTorrent.

Question 5

A small business owner wants to block all social media applications during work hours for employees. The firewall is configured with App-ID and has a security rule that denies the 'social-networking' application category from the internal zone to the internet zone. However, employees are still able to access Facebook and Twitter. The traffic logs show these applications are being allowed by a different rule. The administrator checks the security policy and finds the deny rule for social-networking is present but not matched. What is the most likely reason the deny rule is not being matched?

Accepted Answer

There is a rule above the deny rule that allows all traffic.. The most likely reason the deny rule is not matched is that a higher-priority rule (placed above the deny rule) is allowing all traffic, including social networking. In Palo Alto firewalls, security rules are evaluated from top to bottom; the first matching rule is applied. Even if a deny rule exists for social-networking, if a preceding rule allows all traffic, the deny rule is never evaluated. The traffic logs indicate that the applications are allowed by a different rule, which supports this explanation.

Answer

The source IP address range does not include the employees' subnet.

Answer

The source zone is set to 'any' but the actual traffic is coming from a different zone than assumed.

Answer

The security rule does not have a URL Filtering profile attached.

Question 6

A security administrator is creating a Security policy rule to allow only the business-critical functions of a SaaS application while blocking its social and file-sharing components. The administrator wants the firewall to distinguish between the different functions within the same application. Which App-ID capability should be used to accomplish this?

Accepted Answer

Application functions. Application functions are the mechanism App-ID uses to expose individual capabilities within a single application as separate policy objects. A rule that references a function App-ID can allow or deny that specific behavior without affecting the rest of the application. This is the only option that provides the required per-function granularity within the same SaaS application.

Answer

Application subcategories

Answer

Application filters

Answer

Application containers

Question 7

A security administrator wants to block all peer-to-peer file sharing applications, such as BitTorrent, regardless of the port they use. Which Palo Alto Networks feature should the administrator use to accomplish this?

Accepted Answer

App-ID. App-ID is the feature that identifies applications regardless of port, protocol, or encryption. By using App-ID in a security policy rule, the administrator can deny the BitTorrent application directly, ensuring it is blocked even if it tries to use different ports. This provides accurate application control without relying on port-based rules.

Answer

User-ID

Answer

Content-ID

Answer

Service objects

Question 8

A security administrator notices that a SaaS application is allowed by the security policy, but the firewall is not decrypting the traffic. Without decryption, which Content-ID feature can still identify and control the application's use based on the server certificate?

Accepted Answer

Certificate-based App-ID. Certificate-based App-ID is designed to identify applications by examining the server certificate presented during the TLS handshake, without requiring decryption. This allows enforcement of security policies for SaaS applications while maintaining end-to-end encryption. Decryption profiles, File Blocking, and Data Filtering all require visibility into the payload, which is not available when traffic remains encrypted. Thus, certificate-based App-ID is the correct Content-ID feature for this scenario.

Answer

SSL Decryption profile

Answer

File Blocking profile

Answer

Data Filtering profile

Question 9

A security administrator is configuring a Data Filtering profile to prevent sensitive customer data from leaving the network via webmail. The administrator wants to block any email that contains a U.S. Social Security Number. Which Data Filtering profile setting should be used to detect the SSN pattern?

Accepted Answer

Predefined pattern for Social Security Number. The Data Filtering profile provides predefined patterns for common sensitive data types, including U.S. Social Security Numbers. By selecting the predefined SSN pattern, the administrator can reliably detect and block emails containing SSNs. This leverages built-in regular expressions optimized for accurate detection, avoiding the need for custom patterns that may be error-prone.

Answer

Application override for webmail

Answer

File type matching for .txt files

Answer

Custom pattern using a regular expression

Question 10

A security administrator at a healthcare company needs to detect and block outbound emails that contain patient Social Security numbers. The company uses Microsoft Exchange over SMTP, and the firewall is running PAN-OS 10.1 with the appropriate subscriptions. Which Content-ID feature should the administrator configure to inspect the email body and attachments for sensitive data patterns?

Accepted Answer

Data Filtering profile. Data Filtering profiles are designed to detect and control sensitive information such as credit card numbers, Social Security numbers, and custom patterns within allowed traffic. When applied to a security rule that permits SMTP, the firewall inspects the email body and attachments for these patterns and can block or alert. This is the correct Content-ID feature for preventing outbound emails with patient SSNs.

Answer

Antivirus security profile

Answer

File Blocking profile

Answer

URL Filtering profile

Question 11

A security administrator wants to allow access to a SaaS application but block specific high-risk functions within that application, such as file uploads. The application uses HTTP and HTTPS. Which Palo Alto Networks feature should the administrator use to granularly control application functions?

Accepted Answer

App-ID with application functions. App-ID can identify not only the application but also specific functions within it, such as file upload or posting. By using these application functions in security policy rules, the administrator can allow the SaaS application while blocking high-risk actions like file uploads. This provides granular control without blocking the entire application.

Answer

App-ID with application filters

Answer

Content-ID with Data Filtering

Answer

App-ID with application override

Question 12

A security administrator notices that a Security policy rule permitting the application 'ssl' also allows users to access unauthorized SaaS applications that tunnel their traffic inside TLS on TCP 443. The administrator wants to block these applications without disrupting legitimate TLS traffic. Which Palo Alto Networks feature should be used to identify and control these applications?

Accepted Answer

SSL Decryption with a Forward Proxy certificate and a Decryption policy. The unauthorized SaaS applications are hidden inside TLS, so App-ID alone cannot see them. SSL Decryption with a Forward Proxy certificate allows the firewall to decrypt the traffic, after which App-ID can identify the actual applications. A Decryption policy determines what to decrypt, and Security policy can then block the specific SaaS applications while allowing legitimate TLS. This combination provides granular control without disrupting all TLS traffic.

Answer

QoS policy to rate-limit traffic on port 443

Answer

Application Override policy to force traffic to a custom application

Answer

URL Filtering profile to block the SaaS applications by their web categories

Question 13

A security administrator wants to block all peer-to-peer file sharing applications while allowing web browsing. Which type of security policy rule should they configure?

Accepted Answer

An application-based rule that denies the 'peer-to-peer' application group.. An application-based security policy rule using App-ID can identify and block the 'peer-to-peer' application group, which includes known P2P file sharing applications. This approach is effective regardless of the ports or protocols used. Service-based rules are port-dependent and easily bypassed. URL filtering and decryption rules do not directly block P2P applications. Thus, the application-based rule is the correct choice.

Answer

A URL filtering rule that blocks P2P websites.

Answer

A decryption rule that blocks encrypted P2P traffic.

Answer

A service-based rule that denies TCP ports 6881-6889.

Question 14

A security administrator notices that a large number of unknown TCP sessions are being generated by an internal application. The administrator wants to identify the application using App-ID. Which action should they take first?

Accepted Answer

Use the Application Command Center (ACC) to view unknown applications and their characteristics.. The Application Command Center (ACC) provides detailed visibility into unknown applications, including their traffic patterns and endpoints. By analyzing this information, the administrator can determine if the application is a custom internal tool or a known application that is not yet identified. This is the recommended first step before creating a custom App-ID or contacting support. Other actions like creating a port-based App-ID or enabling logging are not as effective for initial identification.

Answer

Enable logging on the security policy rule to capture the unknown sessions.

Answer

Submit a support ticket to Palo Alto Networks to create a new App-ID.

Answer

Create a custom App-ID based on the destination port.

Question 15

A security administrator is configuring a File Blocking profile to prevent users from downloading executable files from the internet. The administrator wants to ensure that the firewall blocks only the download direction and not the upload direction, while still logging the event. Which configuration should be used?

Accepted Answer

Set the File Blocking profile action to 'block' for the 'exe' file type in the download direction only.. A File Blocking profile can be configured with specific actions per file type and direction. To block only executable downloads while logging, the action for 'exe' should be set to 'block' in the download direction. This prevents executable files from being downloaded, logs the event, and leaves uploads and other file types unaffected. This precise configuration meets the security requirement without unnecessary restrictions.

Answer

Set the File Blocking profile action to 'block' for all file types in the download direction.

Answer

Set the File Blocking profile action to 'alert' for the 'exe' file type in both directions.

Answer

Set the File Blocking profile action to 'continue' for the 'exe' file type in the upload direction only.