PCNSE Securing Traffic and App-ID Practice Test 3 — 15 Questions

Question 1

Given the security policy above, what will happen to an HTTP request from a user to a public website?

Accepted Answer

It will be allowed because rule 1 matches and action is allow.. Rule 1 matches the HTTP request because it typically includes the application 'web-browsing' (or a broader application category) and the action is set to 'allow'. Since security policy evaluation in Palo Alto Networks firewalls is first-match, the traffic is permitted by rule 1 before reaching rule 2. The threat profile does not block the request unless it detects malicious content, which is not indicated in the question.

Answer

It will be allowed but then blocked by the threat profile.

Answer

It will be denied because web-browsing is not identified.

Answer

It will be denied because rule 2 blocks all.

Question 2

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

Accepted Answer

The application override rule does not have the correct port.. An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.

Answer

The traffic is being identified as ssl instead.

Answer

The security policy does not allow the traffic.

Answer

The custom application my-custom-app is not committed.

Question 3

A threat log entry shows a threat detected in SSL traffic to 10.0.0.5, which is a server in the internal network. However, the decryption policy has a rule to no-decrypt traffic to 10.0.0.0/8 from internal sources. What is the most likely reason the threat was detected?

Accepted Answer

The threat was detected in decrypted traffic because the source was external.. The threat was detected because the decryption policy rule 'No-Decrypt-Internal' only applies to traffic where both the source and destination are internal (10.0.0.0/8). If the source is external, the traffic is decrypted by a higher-priority rule (e.g., 'Decrypt-All'), allowing the threat to be inspected and logged. The log entry shows the threat in SSL traffic to 10.0.0.5, but the source being external means the no-decrypt rule does not match, so decryption occurs.

Answer

The decryption policy rule order is incorrect; the 'No-Decrypt-Internal' rule should be after the 'Decrypt-All' rule.

Answer

The threat log is misconfigured.

Answer

The security policy is blocking the traffic before decryption.

Question 4

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

Accepted Answer

SSL decryption is not enabled for the traffic.. When SSL decryption is not enabled, the firewall cannot inspect encrypted HTTPS traffic payloads. As a result, App-ID may classify the traffic as 'incomplete' because it cannot match the encrypted payload to the web-browsing application signature. Enabling SSL decryption allows the firewall to decrypt the traffic, inspect the payload, and correctly identify the application.

Answer

The App-ID signature database is outdated.

Answer

The security policy does not have an allow rule for web-browsing.

Answer

The firewall is experiencing asymmetric routing.

Question 5

A company uses a custom application for internal VoIP traffic. The custom App-ID signature is configured with the correct protocol and port, but traffic is still not matching. The firewall shows the application as 'unknown-tcp'. What should the administrator check next?

Accepted Answer

Ensure a protocol decoder (e.g., SIP) is enabled for the application.. Custom App-ID signatures require a protocol decoder to inspect application-layer payloads. Even if the port and protocol are correctly defined, without an enabled decoder (e.g., SIP for VoIP), the firewall cannot identify the application and falls back to 'unknown-tcp'. Enabling the appropriate decoder allows the firewall to parse the traffic and match the custom signature.

Answer

Verify that the port range in the custom application is correct.

Answer

Update the App-ID signature database.

Answer

Check for asymmetric routing on the firewall.

Question 6

An organization has two different applications (AppA and AppB) that both use TCP port 8080. The firewall must apply different security policies to each application. What is the recommended approach?

Accepted Answer

Create an application override policy to identify each application by IP address.. When two applications share the same TCP port (8080), App-ID cannot differentiate them based on port alone. An application override policy allows you to explicitly identify each application by its source/destination IP address, overriding the default App-ID classification and enabling separate security policies for AppA and AppB.

Answer

Use source/destination IP addresses in security policies instead of App-ID.

Answer

Add the applications on separate virtual wire interfaces.

Answer

Change the port of one application to a different value.

Question 7

A firewall shows session logs with application 'incomplete' for many SSL connections. Which action should be taken to improve App-ID accuracy?

Accepted Answer

Enable SSL decryption for the traffic.. The 'incomplete' application label indicates that the firewall could not fully identify the application because the traffic was encrypted. Enabling SSL decryption allows the firewall to inspect the decrypted payload, which is necessary for App-ID to accurately classify the application. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is often insufficient for SSL connections.

Answer

Disable application identification for SSL traffic.

Answer

Enable HTTP/2 protocol decoding.

Answer

Allow sessions with application 'incomplete' in policy.

Question 8

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

Accepted Answer

Configure an application group and add all related applications.. Using application groups simplifies policy management and ensures consistent policy for related applications. Option A is wrong because wildcard applications are too broad. Option B is wrong because creating a custom container application is not a standard feature. Option D is wrong because removing applications reduces visibility.

Answer

Use a wildcard application for the protocol.

Answer

Create a custom application that covers all the applications.

Answer

Remove the individual applications and just use port-based rules.

Question 9

A firewall in a high-availability pair shows that App-ID signatures are not syncing between units. Sessions are failing over but application identification is incorrect on the passive unit. What should the administrator verify?

Accepted Answer

Ensure both units have the same App-ID license installed.. App-ID signatures are part of the content (App-ID and threat) updates, which require the App-ID license. If both units do not have the same App-ID license installed, the passive unit may lack the necessary signatures, causing incorrect application identification after failover. Verifying that both units have the same license ensures they are eligible to receive the same content updates.

Answer

Configure session distribution for symmetric return.

Answer

Verify that application override policies are replicated via HA configuration sync.

Answer

Check that sessions are established on both units.

Question 10

When configuring a custom application signature, which field is mandatory to define the application?

Accepted Answer

Protocol. In Palo Alto Networks App-ID, when creating a custom application signature, the Protocol field is mandatory because App-ID uses protocol detection as the first step to identify traffic. Without specifying the protocol (e.g., TCP, UDP, or a specific protocol number), the firewall cannot associate the signature with the correct traffic stream, making the application definition incomplete.

Answer

Category

Answer

Port

Answer

Subcategory

Question 11

During a security audit, it is discovered that a custom application signature matches too broadly, causing benign traffic to be classified as the custom app. What change should be made to narrow the signature?

Accepted Answer

Add a data pattern filter to match a specific payload signature.. Adding a data pattern filter allows the custom App-ID signature to match on a specific payload string or byte sequence, which narrows the scope of traffic classified as that application. Without a data pattern, the signature may rely solely on IP protocol, port, or other broad criteria, causing false positives. By requiring a unique payload signature, only traffic containing that exact data pattern is identified as the custom application.

Answer

Remove the protocol field from the signature.

Answer

Use a wider port range and remove data patterns.

Answer

Expand the port range to include more traffic.

Question 12

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Accepted Answer

SSL decryption is not enabled for the session.. App-ID classifies a session as 'incomplete' when it cannot identify the application because it sees only partial traffic. SSL decryption not being enabled prevents the firewall from inspecting encrypted payloads, so App-ID cannot complete its signature-based or heuristic analysis, leaving the session marked as incomplete.

Answer

The firewall CPU is too slow to process packets.

Answer

The content-ID engine has not been licensed.

Answer

A deny rule that blocks the traffic.

Question 13

Which THREE attributes can be used in a custom App-ID signature to identify an application? (Choose three.)

Accepted Answer

Protocol (TCP, UDP, etc.). A is correct because the protocol (TCP, UDP, etc.) is a fundamental attribute used in custom App-ID signatures to define the transport layer over which the application traffic flows. The firewall uses this to match the signature against the correct protocol type, ensuring accurate application identification.

Answer

URL category

Answer

Security policy action

Question 14

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Accepted Answer

Use applications instead of ports in security policies.. App-ID is designed to identify traffic based on application signatures, not ports, enabling more granular and accurate security policy enforcement. Using applications instead of ports allows the firewall to control modern applications that may use non-standard ports or hop between ports, which is a core best practice for Palo Alto Networks firewalls.

Answer

Disable App-ID for traffic that does not match any known application to improve performance.

Answer

Configure all security policies based on port only for consistency.

Answer

Limit application usage to only well-known applications to reduce attack surface.

Question 15

A security administrator notices that HTTP traffic is correctly identified as web-browsing but HTTPS traffic is showing as ssl. The company uses a custom HTTPS-based application that needs to be identified by its own App-ID. What should the administrator do?

Accepted Answer

Enable SSL decryption on the firewall.. Enabling SSL decryption (Option A) is the correct first step to identify a custom HTTPS-based application. App-ID cannot inspect encrypted payloads, so SSL decryption allows the firewall to decrypt traffic for inspection. Once decrypted, the administrator can create a custom App-ID signature based on the application's specific characteristics. Option C is incorrect because an App-ID override is used to bypass App-ID for traffic that should not be inspected, not to define a new application. The question asks for the method to identify the custom application by its own App-ID, and SSL decryption is necessary to enable that identification.

Answer

Configure a custom URL category for the application.

Answer

Create an App-ID override (custom application) for the custom application.

Answer

Disable App-ID for the traffic.