PCNSE Securing Traffic and App-ID — 15 Questions

Question 1

A security engineer notices that traffic from a trusted internal application is being blocked by the firewall. The application communicates using a proprietary protocol over TCP port 8443. The engineer has already created a custom App-ID for this application but the traffic is still being blocked. What is the most likely reason?

Accepted Answer

An application override rule must be configured to associate the custom App-ID with the traffic.. Option D is correct because when a custom App-ID is created for a proprietary protocol, the firewall cannot automatically identify the application by inspecting the traffic. An application override rule is required to explicitly map the traffic (based on IP, port, or other criteria) to the custom App-ID, bypassing the firewall's default App-ID identification process. Without this override, the firewall continues to apply its default classification, which may block the traffic if it doesn't match any known application.

Answer

The custom App-ID must be added to a security profile group.

Answer

The custom App-ID needs a vulnerability profile to be activated.

Answer

The security policy rule uses the destination port instead of App-ID.

Question 2

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

Accepted Answer

The firewall is not seeing the full SSL handshake due to asymmetric routing.. When a firewall operates as a transparent bridge without SSL decryption, it relies on the Server Name Indication (SNI) field or the certificate exchange during the TLS handshake to identify HTTPS traffic as 'ssl'. Asymmetric routing causes the firewall to see only one direction of the TCP handshake (e.g., only the SYN or only the SYN-ACK), preventing it from observing the full TLS handshake. Without the complete handshake, App-ID cannot extract the necessary signatures (e.g., TLS version, cipher suites, certificate details) and falls back to classifying the traffic as 'web-browsing' based on port 443.

Answer

SSL decryption must be enabled for the firewall to correctly identify SSL traffic.

Answer

The default interzone rule is blocking the SSL identification packets.

Answer

The security policy allows 'web-browsing' before 'ssl' in the rule order.

Question 3

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

Accepted Answer

Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.. Option A is correct because App-ID allows you to create a security rule that explicitly allows only the specified applications ('facebook-base' and 'youtube') while implicitly denying all other traffic. Since the default action for any traffic not matching an allow rule is 'deny', this rule achieves the goal of blocking all other applications without needing an explicit block rule.

Answer

Create a security rule with destination port 80 and 443 and action set to 'allow'.

Answer

Create a security profile that blocks all applications not in the allow list.

Answer

Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.

Question 4

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Accepted Answer

An application override rule has not been configured to associate the traffic with the custom App-ID.. The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Answer

The firewall must be rebooted for the custom App-ID to take effect.

Answer

The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

Answer

The firewall cannot identify applications over UDP.

Question 5

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

Accepted Answer

Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.. App-ID is the core mechanism that identifies applications by inspecting traffic beyond port numbers. If the firewall misidentifies the traffic (e.g., as 'ssl' or 'web-browsing' instead of 'ms-update'), the security rule specifically allowing 'ms-update' will not match, and the traffic will be denied by the implicit deny rule. Therefore, verifying App-ID identification is the first logical step.

Answer

Confirm that the source and destination users are correctly configured.

Answer

Ensure that a security profile is applied to the rule to allow the application.

Answer

Check if the rule is placed after a deny-all rule.

Question 6

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Accepted Answer

Using the 'set application' command in the CLI.. Option C is correct because the 'set application' CLI command allows you to define a custom App-ID by specifying characteristics such as protocol, port, and signature. This is a direct method to create a custom application object on a Palo Alto Networks firewall, as documented in the administrator's guide.

Answer

Right-clicking on a session in the Traffic log and selecting 'Create App-ID'.

Answer

Using the 'Application Command Center' to automatically generate custom App-IDs.

Answer

Importing an App-ID definition file from a CSV.

Question 7

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Accepted Answer

Asymmetric routing causes the firewall to see only one direction of traffic.. Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Answer

Multiple security rules are configured for the same traffic.

Answer

Traffic is forwarded through an HTTP proxy.

Question 8

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Accepted Answer

The firewall can buffer up to 1024 KB of packet data for App-ID analysis.. The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Answer

App-ID can only handle 1024 KB of packet data per session.

Answer

The firewall logs the first 1024 KB of every session for App-ID.

Answer

The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.

Question 9

Refer to the exhibit. A network engineer wants to allow only 'ms-update' and 'facebook-base' traffic. After committing the above security policy, they find that 'ssl' traffic is also being allowed. What is the most likely reason?

Accepted Answer

Rule 1 allows all applications because it uses 'application any'.. Rule 1 uses 'application any', which matches all applications regardless of the specific App-ID. Since security policies are evaluated from top to bottom and the first matching rule is applied, any traffic that matches Rule 1's source, destination, and service will be allowed, including 'ssl' traffic. The explicit allow rules for 'ms-update' and 'facebook-base' are irrelevant because Rule 1 catches all traffic first.

Answer

App-ID is not enabled on the firewall.

Answer

Rule 4 is a deny rule but it is not effective because the traffic is allowed earlier.

Answer

The rule order is incorrect; rule 3 should be moved before rule 1.

Question 10

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Accepted Answer

SSL decryption is not enabled for the traffic.. Option C is correct because App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.

Answer

The traffic is allowed by a security policy rule.

Answer

An application override policy is configured for the traffic.

Answer

The firewall is using port-based application identification.

Question 11

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

Accepted Answer

Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.. When security policy rules are not optimized, excessive traffic may be processed by App-ID, causing a backlog of sessions waiting for application identification. The firewall's dataplane can become overwhelmed if too many sessions require deep packet inspection before a decision is made, leading to high CPU utilization and a large number of pending App-ID sessions.

Answer

An application override policy is being used extensively.

Answer

SSL decryption is disabled for most traffic.

Answer

The application database is outdated and missing signatures.

Question 12

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

Accepted Answer

Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.. Option A is correct because App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.

Answer

Enable unknown application identification in the security rule.

Answer

Use the default application override for port 4444 to allow traffic.

Answer

Change the security rule to use 'application-default' as the service to rely on port-based identification.

Question 13

A network engineer is troubleshooting an issue where a web application is being incorrectly identified as 'web-browsing' instead of 'webmail-gmail' by the Palo Alto Networks firewall. The firewall has App-ID enabled and all signatures are up to date. Which TWO actions should the engineer take to resolve this misidentification?

Accepted Answer

Review the session log to see if the application changed during the session.. Option C is correct because App-ID can reclassify a session as more data becomes available. A session that starts as 'web-browsing' may later be identified as 'webmail-gmail' once the firewall sees application-specific traffic (e.g., SMTP, IMAP, or proprietary Gmail API calls). Reviewing the session log to see if the application changed during the session helps confirm whether the firewall eventually identified the correct application.

Answer

Disable unknown application identification to force stricter matching.

Answer

Create a custom App-ID for webmail-gmail with stricter signatures.

Answer

Increase the application identification timeout to allow more time for identification.

Question 14

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Question 15

Order the steps to upgrade the PAN-OS software on a standalone firewall.