PCNSE Securing Traffic and App-ID Practice Test 2 — 15 Questions

Question 1

Match each PAN-OS component to its description.

Question 2

Match each decryption type to its description.

Question 3

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

Accepted Answer

Create a new application and define the default port.. The first step is to create a new application object and define the default port. Creating an application group or filter assumes the application already exists. Tags are optional labels.

Answer

Create a new application group.

Answer

Create a new custom application tag.

Answer

Create a new application filter.

Question 4

An engineer wants to block all peer-to-peer file sharing traffic using App-ID. What security policy action should be used?

Accepted Answer

Deny.. The standard action to block traffic in a security policy rule is 'deny'. 'Drop' also blocks but does not send a TCP reset, while 'deny' sends a reset. 'Allow' would permit the traffic, and 'reset-both' is a type of deny, but 'deny' is the typical best practice.

Answer

Drop.

Answer

Reset-both.

Answer

Allow with antivirus profile.

Question 5

A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?

Accepted Answer

The application override is not configured.. Since the custom application signature exists but is not being used, the firewall's default identification overrides it. Configuring an application override forces the firewall to use the custom application's signature instead of the default one.

Answer

The custom application is not activated in the security policy rule.

Answer

The vulnerability protection profile is dropping the traffic.

Answer

The decryption policy is blocking the traffic.

Question 6

A security team is deploying SSL Decryption for inbound traffic to protect against threats hidden in encrypted traffic. However, they want to exclude financial transactions that use client certificates for authentication. What is the best approach?

Accepted Answer

Use a decryption policy rule with 'No Decrypt' action for the financial application.. The decryption policy allows you to set 'No Decrypt' action based on application or URL. Using an application identifier is precise and does not rely on URL categories, which may be broad.

Answer

Create a decryption policy rule with a condition matching the client certificate.

Answer

Create a decryption policy rule that excludes the financial application based on URL category.

Answer

Use an SSL Forward Proxy decryption profile with 'Exclude Certificate' list.

Question 7

An engineer wants to block the use of file-sharing application BitTorrent, but allow file transfers over SFTP which also uses port 22. What is the most effective way to achieve this using App-ID?

Accepted Answer

Create a security rule that denies application 'bittorrent' and allows application 'sftp'.. App-ID can differentiate between applications on the same port. Creating separate security rules for each application allows blocking one and allowing the other.

Answer

Create an application filter that matches sftp.

Answer

Use QoS to limit BitTorrent traffic.

Answer

Use an application override to classify all port 22 traffic as sftp.

Question 8

During an audit, it is discovered that some traffic from a legacy application is being incorrectly identified as 'ssl' because the application uses a custom encryption scheme over TCP port 443. The engineer has created a custom application signature that matches the legacy application's handshake. What additional configuration is needed to ensure the legacy application is correctly identified?

Accepted Answer

Create an application override rule to force the identification.. Since the traffic uses port 443, the firewall's default SSL decoder identifies it as 'ssl'. An application override forces the firewall to use the custom signature instead.

Answer

Create a security policy rule that explicitly allows the custom application.

Answer

Change the default port of the custom application from 443 to a different port.

Answer

Disable SSL decryption for that traffic.

Question 9

A company has a Palo Alto Networks firewall in a high-availability active/passive setup. After a failover event, the new active firewall is not correctly identifying some custom applications. The custom application objects and signatures are synchronized via Panorama. What is the most likely cause?

Accepted Answer

The custom application objects were created locally on the previous active firewall and not pushed from Panorama.. If custom applications were created locally on the previous active firewall, they would not be present on the new active. Panorama push should include them, but if they were local, they would be missing.

Answer

The application override rules are not synchronized.

Answer

The security policy rules referencing the custom applications are not present.

Answer

The custom application signatures are not committed on the new active firewall.

Question 10

An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?

Answer

The SSL Forward Proxy profile is set to ignore the decryption policy.

Answer

The firewall is using a different decryption port than 443.

Answer

The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.

Answer

The URL category for banking is not correctly identified.

Question 11

A network security engineer is troubleshooting an issue where certain VoIP traffic is being dropped by the firewall. The traffic logs show that the application is identified as 'voip' and the security rule allows 'voip'. However, the traffic is still being dropped. What should the engineer check next?

Accepted Answer

Check if a vulnerability protection profile is dropping the traffic based on a threat signature.. Even if a security rule allows traffic, security profiles (such as vulnerability protection, antivirus, etc.) can drop traffic. The threat logs should be checked for profile drops.

Answer

Confirm that the VoIP protocol is supported by App-ID.

Answer

Ensure that the security rule action is set to 'allow' and not 'deny'.

Answer

Verify that the application override is not set for this traffic.

Question 12

A security administrator needs to block an application that uses multiple ports, including dynamic ports. Which of the following methods can be used to block this application using App-ID? (Choose two.)

Accepted Answer

Create a security rule with the application set to the malicious application and action Deny.. Creating a security rule with the application set denies traffic based on App-ID identification, independent of port. A custom application can define multiple default ports to aid identification, but the key is that denial is based on application identity, not port.

Answer

Create an application override to force identification of the application on all ports.

Answer

Use decryption to inspect the application content.

Answer

Create a security rule with the destination port range that covers all possible ports.

Question 13

An engineer is configuring App-ID for a network that uses both standard and custom applications. Which of the following are best practices for using App-ID effectively? (Choose three.)

Accepted Answer

Use application filters to create dynamic application groups based on characteristics.. Using application groups simplifies policy management. Regular updates ensure accurate identification. Application filters allow dynamic grouping based on characteristics. Relying solely on default signatures may miss custom apps, and disabling App-ID on well-known ports reduces visibility.

Answer

Rely solely on default application signatures for all traffic identification.

Answer

Disable App-ID for traffic on well-known ports to reduce processing overhead.

Question 14

During a security incident, an analyst notices that certain malware traffic is using port 443 but is being identified as 'ssl'. The malware uses a unique handshake that differs from standard SSL. Which two actions should the analyst take to correctly identify and block this malware? (Choose two.)

Accepted Answer

Create a custom application signature that matches the malware handshake.. First, create a custom application signature that matches the malware handshake. Then, apply an application override to force the firewall to use that signature instead of the default 'ssl' identification. After identification, the malware can be blocked via a security rule, but the question focuses on identification.

Answer

Add the custom application to a security rule with action Deny.

Answer

Disable SSL decryption on the firewall.

Answer

Create a decryption policy to forward proxy decrypt the traffic.

Question 15

Given the security policy above, what will happen to an HTTP request from a user to a public website?

Accepted Answer

It will be allowed because rule 1 matches and action is allow.. The HTTP traffic will be identified as 'web-browsing' and match rule 1 first. The action is 'allow', so the traffic is permitted. The threat profile inspects but does not block unless a threat is found.

Answer

It will be allowed but then blocked by the threat profile.

Answer

It will be denied because web-browsing is not identified.

Answer

It will be denied because rule 2 blocks all.