PCNSE Securing Traffic and App-ID — 25 Questions

Question 1

During a security incident, an analyst notices that certain malware traffic is using port 443 but is being identified as 'ssl'. The malware uses a unique handshake that differs from standard SSL. Which two actions should the analyst take to correctly identify and block this malware? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom application signature that matches the malware handshake.. Options C and E are correct. Creating a custom application signature (C) enables the firewall to identify the malware based on its unique handshake, bypassing the default SSL identification. Then, creating an application override rule (E) forces the firewall to treat the traffic as that custom application, allowing it to match a security rule with action Deny. Option A is incorrect because without identification, a security rule cannot block the traffic. Option B is incorrect as disabling decryption prevents visibility into encrypted payloads. Option D is incorrect because decryption is not required for identification via App-ID.

Answer

Add the custom application to a security rule with action Deny.

Answer

Disable SSL decryption on the firewall.

Answer

Create a decryption policy to forward proxy decrypt the traffic.

Question 2

A security policy has an application list with 'facebook-chat' and 'facebook-base'. A user reports that Facebook messages are being blocked. The firewall logs show the application as 'facebook-base' but not as 'facebook-chat'. What is the most likely reason?

Accepted Answer

The application 'facebook-chat' is a dependency that is not allowed in the policy.. 'facebook-chat' is a dependent application of 'facebook-base'. In Palo Alto Networks App-ID, dependent applications are sub-applications that are only identified when the parent application is detected. The logs show only 'facebook-base', indicating the traffic does not contain the specific characteristics to be identified as 'facebook-chat'. Although the policy explicitly lists both applications, the firewall identifies only one application per session. Since the traffic is matched to 'facebook-base', the 'facebook-chat' dependent application is not separately allowed, and the user's chat messages are blocked because they are not being recognized as the chat application.

Answer

The App-ID signature for 'facebook-chat' is outdated.

Answer

The firewall is blocking the application 'facebook-chat' due to content filtering.

Answer

The traffic is using a non-standard port for chat.

Question 3

A security engineer notices that traffic from a trusted internal application is being blocked by the firewall. The application communicates using a proprietary protocol over TCP port 8443. The engineer has already created a custom App-ID for this application but the traffic is still being blocked. What is the most likely reason?

Accepted Answer

An application override rule must be configured to associate the custom App-ID with the traffic.. When a custom App-ID is created for a proprietary protocol, the firewall cannot automatically identify the application by inspecting the traffic. An application override rule is required to explicitly map the traffic (based on IP, port, or other criteria) to the custom App-ID, bypassing the firewall's default App-ID identification process. Without this override, the firewall continues to apply its default classification, which may block the traffic if it doesn't match any known application.

Answer

The custom App-ID must be added to a security profile group.

Answer

The custom App-ID needs a vulnerability profile to be activated.

Answer

The security policy rule uses the destination port instead of App-ID.

Question 4

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

Accepted Answer

The firewall is not seeing the full SSL handshake due to asymmetric routing.. When a firewall operates as a transparent bridge without SSL decryption, it relies on the Server Name Indication (SNI) field or the certificate exchange during the TLS handshake to identify HTTPS traffic as 'ssl'. Asymmetric routing causes the firewall to see only one direction of the TCP handshake (e.g., only the SYN or only the SYN-ACK), preventing it from observing the full TLS handshake. Without the complete handshake, App-ID cannot extract the necessary signatures (e.g., TLS version, cipher suites, certificate details) and falls back to classifying the traffic as 'web-browsing' based on port 443.

Answer

SSL decryption must be enabled for the firewall to correctly identify SSL traffic.

Answer

The default interzone rule is blocking the SSL identification packets.

Answer

The security policy allows 'web-browsing' before 'ssl' in the rule order.

Question 5

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

Accepted Answer

Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.. App-ID allows you to create a security rule that explicitly allows only the specified applications ('facebook-base' and 'youtube') while implicitly denying all other traffic. Since the default action for any traffic not matching an allow rule is 'deny', this rule achieves the goal of blocking all other applications without needing an explicit block rule.

Answer

Create a security rule with destination port 80 and 443 and action set to 'allow'.

Answer

Create a security profile that blocks all applications not in the allow list.

Answer

Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.

Question 6

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Accepted Answer

An application override rule has not been configured to associate the traffic with the custom App-ID.. The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Answer

The firewall must be rebooted for the custom App-ID to take effect.

Answer

The custom App-ID must be enabled in the 'Applications' section of the firewall settings.

Answer

The firewall cannot identify applications over UDP.

Question 7

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

Accepted Answer

Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.. App-ID is the core mechanism that identifies applications by inspecting traffic beyond port numbers. If the firewall misidentifies the traffic (e.g., as 'ssl' or 'web-browsing' instead of 'ms-update'), the security rule specifically allowing 'ms-update' will not match, and the traffic will be denied by the implicit deny rule. Therefore, verifying App-ID identification is the first logical step.

Answer

Confirm that the source and destination users are correctly configured.

Answer

Ensure that a security profile is applied to the rule to allow the application.

Answer

Check if the rule is placed after a deny-all rule.

Question 8

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Accepted Answer

Using the 'set application' command in the CLI.. The 'set application' CLI command allows you to define a custom App-ID by specifying characteristics such as protocol, port, and signature. This is a direct method to create a custom application object on a Palo Alto Networks firewall, as documented in the administrator's guide.

Answer

Right-clicking on a session in the Traffic log and selecting 'Create App-ID'.

Answer

Using the 'Application Command Center' to automatically generate custom App-IDs.

Answer

Importing an App-ID definition file from a CSV.

Question 9

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Accepted Answer

Asymmetric routing causes the firewall to see only one direction of traffic.. Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Answer

Multiple security rules are configured for the same traffic.

Answer

Traffic is forwarded through an HTTP proxy.

Question 10

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Accepted Answer

The firewall can buffer up to 1024 KB of packet data for App-ID analysis.. The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Answer

App-ID can only handle 1024 KB of packet data per session.

Answer

The firewall logs the first 1024 KB of every session for App-ID.

Answer

The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.

Question 11

Refer to the exhibit. A network engineer wants to allow only 'ms-update' and 'facebook-base' traffic. After committing the above security policy, they find that 'ssl' traffic is also being allowed. What is the most likely reason?

Accepted Answer

Rule 1 allows all applications because it uses 'application any'.. Rule 1 uses 'application any', which matches all applications regardless of the specific App-ID. Since security policies are evaluated from top to bottom and the first matching rule is applied, any traffic that matches Rule 1's source, destination, and service will be allowed, including 'ssl' traffic. The explicit allow rules for 'ms-update' and 'facebook-base' are irrelevant because Rule 1 catches all traffic first.

Answer

App-ID is not enabled on the firewall.

Answer

Rule 4 is a deny rule but it is not effective because the traffic is allowed earlier.

Answer

The rule order is incorrect; rule 3 should be moved before rule 1.

Question 12

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Accepted Answer

SSL decryption is not enabled for the traffic.. App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.

Answer

The traffic is allowed by a security policy rule.

Answer

An application override policy is configured for the traffic.

Answer

The firewall is using port-based application identification.

Question 13

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

Accepted Answer

Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.. When security policy rules are not optimized, excessive traffic may be processed by App-ID, causing a backlog of sessions waiting for application identification. The firewall's dataplane can become overwhelmed if too many sessions require deep packet inspection before a decision is made, leading to high CPU utilization and a large number of pending App-ID sessions.

Answer

An application override policy is being used extensively.

Answer

SSL decryption is disabled for most traffic.

Answer

The application database is outdated and missing signatures.

Question 14

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

Accepted Answer

Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.. App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.

Answer

Enable unknown application identification in the security rule.

Answer

Use the default application override for port 4444 to allow traffic.

Answer

Change the security rule to use 'application-default' as the service to rely on port-based identification.

Question 15

A network engineer is troubleshooting an issue where a web application is being incorrectly identified as 'web-browsing' instead of 'webmail-gmail' by the Palo Alto Networks firewall. The firewall has App-ID enabled and all signatures are up to date. Which TWO actions should the engineer take to resolve this misidentification?

Accepted Answer

Review the session log to see if the application changed during the session.. App-ID can reclassify a session as more data becomes available. A session that starts as 'web-browsing' may later be identified as 'webmail-gmail' once the firewall sees application-specific traffic (e.g., SMTP, IMAP, or proprietary Gmail API calls). Reviewing the session log to see if the application changed during the session helps confirm whether the firewall eventually identified the correct application.

Answer

Disable unknown application identification to force stricter matching.

Answer

Create a custom App-ID for webmail-gmail with stricter signatures.

Answer

Increase the application identification timeout to allow more time for identification.

Question 16

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Accepted Answer

Step 1: Specify source zone (Inside) and source addresses (any). Step 2: Specify destination zone (Outside) and destination addresses (any). Step 3: Select application (web-browsing) and set service to application-default. Step 4: Set action to allow. Step 5: Commit the configuration.. Configuring a security policy on Palo Alto Networks firewalls involves defining the traffic flow by specifying source and destination zones, then selecting the application and service, setting the action (allow or deny), and finally committing the changes. The correct order ensures logical consistency and proper policy enforcement. Common mistakes include swapping zones, setting action before application, or placing destination after application.

Answer

Step 1: Specify destination zone (Outside) and destination addresses (any). Step 2: Specify source zone (Inside) and source addresses (any). Step 3: Select application (web-browsing) and set service to application-default. Step 4: Set action to allow. Step 5: Commit the configuration.

Answer

Step 1: Specify source zone (Inside) and source addresses (any). Step 2: Select application (web-browsing) and set service to application-default. Step 3: Specify destination zone (Outside) and destination addresses (any). Step 4: Set action to allow. Step 5: Commit the configuration.

Answer

Step 1: Specify source zone (Inside) and source addresses (any). Step 2: Specify destination zone (Outside) and destination addresses (any). Step 3: Set action to allow. Step 4: Select application (web-browsing) and set service to application-default. Step 5: Commit the configuration.

Question 17

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Accepted Answer

Download, then Upload, then Install, then Reboot, then Verify. The correct sequence for upgrading PAN-OS on a standalone firewall is: Download the new image from the support portal, Upload it to the firewall, Install the image, Reboot the firewall to load the new version, and Verify the upgrade was successful. Common mistakes include swapping the order of upload and download, installing before upload, or reboot before install.

Answer

Download, then Install, then Upload, then Reboot, then Verify

Answer

Upload, then Download, then Install, then Reboot, then Verify

Answer

Download, then Upload, then Reboot, then Install, then Verify

Question 18

Match each PAN-OS component to its description.

Accepted Answer

Management Plane: Handles configuration, logging, and management interface.. PAN-OS architecture separates management, data, and control functions into distinct planes. The Management Plane handles configuration and logging; the Data Plane processes traffic; the Control Plane manages routing and sessions. Panorama is a centralized management tool, not a plane within a single firewall.

Answer

Management Plane: Processes and forwards network traffic through hardware acceleration.

Answer

Data Plane: Manages routing protocols and session state synchronization.

Question 19

Match each decryption type to its description.

Accepted Answer

SSL Forward Proxy: Decrypts outbound SSL/TLS traffic from internal clients to external servers.. Correct matches: SSL Forward Proxy decrypts outbound traffic; SSL Inbound Inspection decrypts inbound traffic; SSH Proxy inspects SSH; Decryption Mirror duplicates decrypted traffic. Common confusion is swapping the direction of SSL decryption types.

Answer

SSL Forward Proxy: Decrypts inbound SSL/TLS traffic destined for internal servers.

Answer

SSL Inbound Inspection: Decrypts outbound SSL/TLS traffic from internal clients.

Question 20

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

Accepted Answer

Create a new application and define the default port.. To create a custom application for a proprietary database protocol using TCP port 7890, the first step is to create a new application and define the default port. In App-ID, custom applications are defined by specifying the application name, the protocol (TCP/UDP), and the default port number, which allows the firewall to identify traffic for that application based on the port. This is the foundational step before any additional properties like timeouts or advanced settings can be configured.

Answer

Create a new application group.

Answer

Create a new custom application tag.

Answer

Create a new application filter.