PCNSE Practice Test 14 — 15 Questions

Question 1

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

Accepted Answer

SSL decryption is not enabled for the traffic.. Option D is correct because SSL decryption is required to inspect encrypted traffic for App-ID to identify applications beyond the SSL protocol itself. Without decryption, the traffic may remain as 'incomplete' if the payload is encrypted. Option A is wrong because App-ID updates do not affect classification of encrypted traffic without decryption. Option B is wrong because policy configuration does not cause incomplete classification. Option C is wrong because asymmetric routing can cause incomplete, but it is less common than lack of decryption in this scenario.

Answer

The App-ID signature database is outdated.

Answer

The security policy does not have an allow rule for web-browsing.

Answer

The firewall is experiencing asymmetric routing.

Question 2

Which THREE attributes can be used in a custom App-ID signature to identify an application? (Choose three.)

Accepted Answer

Protocol (TCP, UDP, etc.). Options A, C, and E are correct. Protocol (A) is the base attribute; data pattern (C) matches payload content; port (E) can define known ports. Option B is incorrect because security policies are not part of signature definition. Option D is incorrect because URL category is for URL filtering, not App-ID signature.

Answer

URL category

Answer

Security policy action

Question 3

A company uses a custom application for internal VoIP traffic. The custom App-ID signature is configured with the correct protocol and port, but traffic is still not matching. The firewall shows the application as 'unknown-tcp'. What should the administrator check next?

Accepted Answer

Ensure a protocol decoder (e.g., SIP) is enabled for the application.. Option C is correct because many VoIP applications use dynamic ports after initial connection, so a protocol decoder (like SIP or H.323) may be needed. Option A is incorrect because the port is already configured. Option B is incorrect because asymmetric routing would affect detection but is less likely for internal VoIP. Option D is incorrect because signature updates are not relevant for custom apps.

Answer

Verify that the port range in the custom application is correct.

Answer

Update the App-ID signature database.

Answer

Check for asymmetric routing on the firewall.

Question 4

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Accepted Answer

Use applications instead of ports in security policies.. Options A and C are correct. Option A: Using application-based policy improves security and flexibility. Option C: Combining App-ID with other security profiles (e.g., content-ID) enables comprehensive inspection. Option B is wrong because disabling App-ID for all traffic defeats the purpose. Option D is wrong because relying solely on ports is not recommended. Option E is wrong because using only well-known applications reduces visibility.

Answer

Disable App-ID for traffic that does not match any known application to improve performance.

Answer

Configure all security policies based on port only for consistency.

Answer

Limit application usage to only well-known applications to reduce attack surface.

Question 5

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

Accepted Answer

Configure an application group and add all related applications.. Option C is correct because using application groups simplifies policy management and ensures consistent policy for related applications. Option A is wrong because wildcard applications are too broad. Option B is wrong because creating a custom container application is not a standard feature. Option D is wrong because removing applications reduces visibility.

Answer

Use a wildcard application for the protocol.

Answer

Create a custom application that covers all the applications.

Answer

Remove the individual applications and just use port-based rules.

Question 6

During a security audit, an administrator finds that traffic on TCP port 443 is classified as web-browsing, but the firewall is configured to use SSL decryption. However, the traffic is not decrypted because it uses a self-signed certificate from an internal CA that is not trusted by the firewall. How should the administrator fix this to enable proper App-ID?

Accepted Answer

Import the internal CA certificate and enable SSL forward proxy.. Option A is correct: importing the internal CA certificate and enabling SSL forward proxy with that CA allows the firewall to decrypt traffic using self-signed certificates, enabling App-ID to see the true application. Option B is wrong because disabling SSL decryption for that traffic would prevent identification. Option C is wrong because using SSH decryption is for SSH, not HTTPS. Option D is wrong because a custom App-ID override does not address the decryption issue.

Answer

Configure SSH decryption for the traffic.

Answer

Disable SSL decryption for that traffic and rely on port-based identification.

Answer

Create a custom App-ID override for the application.

Question 7

A firewall in a high-availability pair shows that App-ID signatures are not syncing between units. Sessions are failing over but application identification is incorrect on the passive unit. What should the administrator verify?

Accepted Answer

Verify that application override policies are replicated via HA configuration sync.. Option D is correct because application override policies are not synced via HA; they are local. Option A is wrong because license is not per-unit. Option B is wrong because session setup is not the issue. Option C is wrong because session distribution does not affect identification.

Answer

Ensure both units have the same App-ID license installed.

Answer

Configure session distribution for symmetric return.

Answer

Check that sessions are established on both units.

Question 8

An administrator wants to apply different security policies for different applications that may use the same IP addresses and ports. Which firewall configuration feature should be used?

Accepted Answer

Security policy with App-ID. Option D is correct: Security policies with App-ID allow you to define rules based on the identified application, enabling different policies for different applications on the same IP/port. Option A is wrong because Application Override bypasses App-ID. Option B is wrong because Decryption policy does not enforce access control. Option C is wrong because QoS only prioritizes traffic, does not filter.

Answer

Application Override

Answer

Quality of Service (QoS) policy

Answer

Decryption policy

Question 9

When configuring a custom application signature, which field is mandatory to define the application?

Accepted Answer

Protocol. Option B is correct because the protocol (TCP, UDP, etc.) is required for signature matching. Option A is wrong because category is optional. Option C is wrong because ports are optional if using protocol decoder. Option D is wrong because subcategory is optional.

Answer

Category

Answer

Port

Answer

Subcategory

Question 10

After upgrading PAN-OS from version 9.1 to 10.0, an administrator notices that traffic for an internal custom application is now classified as unknown-tcp instead of the expected custom application. The application was defined using a custom App-ID in the previous version. What is the most likely cause?

Accepted Answer

The custom App-ID is incompatible with the new version and needs to be re-created.. Option B is correct: Custom App-IDs may not be compatible with the new PAN-OS version and might need to be re-created or updated. Option A is wrong because application signatures are not automatically deprecated without custom App-ID issues. Option C is wrong because the upgrade does not typically reset configurations. Option D is wrong because the license is not directly relevant to App-ID.

Answer

The new version deprecated the application signature.

Answer

The firewall license expired after the upgrade.

Answer

The upgrade reset the firewall configuration.

Question 11

A security policy has an application list with 'facebook-chat' and 'facebook-base'. A user reports that Facebook messages are being blocked. The firewall logs show the application as 'facebook-base' but not as 'facebook-chat'. What is the most likely reason?

Accepted Answer

The application 'facebook-chat' is a dependency that is not allowed in the policy.. Option A is correct because 'facebook-chat' is a dependent application of 'facebook-base'; if the policy only allows 'facebook-base', the dependency may not be automatically included. Option B is wrong because signature updates are not the cause. Option C is wrong because ports are not the issue. Option D is wrong because blocking is not causing missing application.

Answer

The App-ID signature for 'facebook-chat' is outdated.

Answer

The firewall is blocking the application 'facebook-chat' due to content filtering.

Answer

The traffic is using a non-standard port for chat.

Question 12

A network administrator wants to ensure that all traffic traversing the firewall is correctly identified by App-ID before any security policies are evaluated. Which step is essential?

Accepted Answer

Ensure App-ID is enabled in the security policy rules.. Option A is correct: App-ID must be enabled in the security policy rule (or globally) to ensure identification occurs before policy evaluation. Option B is wrong because App-ID does not require enabling on interfaces separately. Option C is wrong because zones define traffic boundaries, not App-ID. Option D is wrong because threat prevention is unrelated to App-ID.

Answer

Enable App-ID on the firewall interfaces.

Answer

Configure security zones properly.

Answer

Enable Threat Prevention profiles.

Question 13

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Accepted Answer

SSL decryption is not enabled for the session.. Options A and D are correct. Option A: Asymmetric routing can cause incomplete because the firewall may only see half the session. Option D: SSL decryption not enabled for encrypted traffic prevents full inspection of the payload. Option B is wrong because policy configuration does not affect classification. Option C is wrong because slow processing does not cause incomplete; it may cause packet drops but not incomplete. Option E is wrong because content-ID is separate and not directly causing incomplete.

Answer

The firewall CPU is too slow to process packets.

Answer

The content-ID engine has not been licensed.

Answer

A deny rule that blocks the traffic.

Question 14

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

Accepted Answer

Create a custom application with a hostname condition.. Options A and B are correct: Enabling SSL forward proxy with the internal CA allows decryption to see the SNI, and creating a custom application with a hostname condition uses that SNI for identification. Option C is wrong because disabling App-ID on that port prevents identification. Option D is wrong because an application override bypasses App-ID. Option E is wrong because URL categories do not affect App-ID.

Answer

Disable App-ID on port 8443.

Answer

Use an application override with port 8443.

Answer

Add a custom URL category for the domain.

Question 15

A security administrator notices that HTTP traffic is correctly identified as web-browsing but HTTPS traffic is showing as ssl. The company uses a custom HTTPS-based application that needs to be identified by its own App-ID. What should the administrator do?

Accepted Answer

Create an App-ID override (custom application) for the custom application.. Option B is correct because creating an App-ID override allows the administrator to define a custom application signature for the traffic, ensuring it is identified as the custom application rather than ssl. Option A is wrong because configuring a custom URL category does not affect App-ID. Option C is wrong because SSL decryption alone does not change the application identity; it only allows inspection. Option D is wrong because disabling App-ID would bypass application identification entirely.

Answer

Enable SSL decryption on the firewall.

Answer

Configure a custom URL category for the application.

Answer

Disable App-ID for the traffic.