PCNSE Securing Traffic and App-ID Practice Test 3 — 15 Questions

Question 1

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

Accepted Answer

The application override rule does not have the correct port.. The application override rule does not specify a port or service. By default, app override rules require a port to match; without it, the rule fails to match, and traffic is identified by default signatures.

Answer

The traffic is being identified as ssl instead.

Answer

The security policy does not allow the traffic.

Answer

The custom application my-custom-app is not committed.

Question 2

A threat log entry shows a threat detected in SSL traffic to 10.0.0.5, which is a server in the internal network. However, the decryption policy has a rule to no-decrypt traffic to 10.0.0.0/8 from internal sources. What is the most likely reason the threat was detected?

Accepted Answer

The threat was detected in decrypted traffic because the source was external.. The 'No-Decrypt-Internal' rule applies only to source addresses in 192.168.0.0/16. If the source of the traffic is not within that range (e.g., external), then the traffic to 10.0.0.5 matches the 'Decrypt-All' rule and is decrypted, allowing threat detection.

Answer

The decryption policy rule order is incorrect; the 'No-Decrypt-Internal' rule should be after the 'Decrypt-All' rule.

Answer

The threat log is misconfigured.

Answer

The security policy is blocking the traffic before decryption.

Question 3

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

Accepted Answer

SSL decryption is not enabled for the traffic.. Option D is correct because SSL decryption is required to inspect encrypted traffic for App-ID to identify applications beyond the SSL protocol itself. Without decryption, the traffic may remain as 'incomplete' if the payload is encrypted. Option A is wrong because App-ID updates do not affect classification of encrypted traffic without decryption. Option B is wrong because policy configuration does not cause incomplete classification. Option C is wrong because asymmetric routing can cause incomplete, but it is less common than lack of decryption in this scenario.

Answer

The App-ID signature database is outdated.

Answer

The security policy does not have an allow rule for web-browsing.

Answer

The firewall is experiencing asymmetric routing.

Question 4

A company uses a custom application for internal VoIP traffic. The custom App-ID signature is configured with the correct protocol and port, but traffic is still not matching. The firewall shows the application as 'unknown-tcp'. What should the administrator check next?

Accepted Answer

Ensure a protocol decoder (e.g., SIP) is enabled for the application.. Option C is correct because many VoIP applications use dynamic ports after initial connection, so a protocol decoder (like SIP or H.323) may be needed. Option A is incorrect because the port is already configured. Option B is incorrect because asymmetric routing would affect detection but is less likely for internal VoIP. Option D is incorrect because signature updates are not relevant for custom apps.

Answer

Verify that the port range in the custom application is correct.

Answer

Update the App-ID signature database.

Answer

Check for asymmetric routing on the firewall.

Question 5

An organization has two different applications (AppA and AppB) that both use TCP port 8080. The firewall must apply different security policies to each application. What is the recommended approach?

Accepted Answer

Create an application override policy to identify each application by IP address.. Option B is correct because application override allows you to force a custom application identification based on criteria like IP addresses, even on the same port. Option A is wrong because changing port is not always feasible. Option C is wrong because using only IP addresses is not sufficient for port sharing. Option D is wrong because additional interfaces do not solve the identification problem.

Answer

Use source/destination IP addresses in security policies instead of App-ID.

Answer

Add the applications on separate virtual wire interfaces.

Answer

Change the port of one application to a different value.

Question 6

A firewall shows session logs with application 'incomplete' for many SSL connections. Which action should be taken to improve App-ID accuracy?

Accepted Answer

Enable SSL decryption for the traffic.. Option A is correct because SSL decryption allows the firewall to inspect encrypted content, improving application identification. Option B is wrong because allowing incomplete sessions does not improve accuracy. Option C is wrong because disabling security policies is not necessary. Option D is wrong because enabling HTTP/2 is not directly relevant.

Answer

Disable application identification for SSL traffic.

Answer

Enable HTTP/2 protocol decoding.

Answer

Allow sessions with application 'incomplete' in policy.

Question 7

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

Accepted Answer

Configure an application group and add all related applications.. Option C is correct because using application groups simplifies policy management and ensures consistent policy for related applications. Option A is wrong because wildcard applications are too broad. Option B is wrong because creating a custom container application is not a standard feature. Option D is wrong because removing applications reduces visibility.

Answer

Use a wildcard application for the protocol.

Answer

Create a custom application that covers all the applications.

Answer

Remove the individual applications and just use port-based rules.

Question 8

A firewall in a high-availability pair shows that App-ID signatures are not syncing between units. Sessions are failing over but application identification is incorrect on the passive unit. What should the administrator verify?

Accepted Answer

Verify that application override policies are replicated via HA configuration sync.. Option D is correct because application override policies are not synced via HA; they are local. Option A is wrong because license is not per-unit. Option B is wrong because session setup is not the issue. Option C is wrong because session distribution does not affect identification.

Answer

Ensure both units have the same App-ID license installed.

Answer

Configure session distribution for symmetric return.

Answer

Check that sessions are established on both units.

Question 9

When configuring a custom application signature, which field is mandatory to define the application?

Accepted Answer

Protocol. Option B is correct because the protocol (TCP, UDP, etc.) is required for signature matching. Option A is wrong because category is optional. Option C is wrong because ports are optional if using protocol decoder. Option D is wrong because subcategory is optional.

Answer

Category

Answer

Port

Answer

Subcategory

Question 10

A security policy has an application list with 'facebook-chat' and 'facebook-base'. A user reports that Facebook messages are being blocked. The firewall logs show the application as 'facebook-base' but not as 'facebook-chat'. What is the most likely reason?

Accepted Answer

The application 'facebook-chat' is a dependency that is not allowed in the policy.. Option A is correct because 'facebook-chat' is a dependent application of 'facebook-base'; if the policy only allows 'facebook-base', the dependency may not be automatically included. Option B is wrong because signature updates are not the cause. Option C is wrong because ports are not the issue. Option D is wrong because blocking is not causing missing application.

Answer

The App-ID signature for 'facebook-chat' is outdated.

Answer

The firewall is blocking the application 'facebook-chat' due to content filtering.

Answer

The traffic is using a non-standard port for chat.

Question 11

During a security audit, it is discovered that a custom application signature matches too broadly, causing benign traffic to be classified as the custom app. What change should be made to narrow the signature?

Accepted Answer

Add a data pattern filter to match a specific payload signature.. Option D is correct because adding a data pattern filter (e.g., specific byte sequence) increases precision. Option A is wrong because removing protocol makes it broader. Option B is wrong because expanding port range makes it broader. Option C is wrong because port ranges are not causal for overmatching if the data pattern is missing.

Answer

Remove the protocol field from the signature.

Answer

Use a wider port range and remove data patterns.

Answer

Expand the port range to include more traffic.

Question 12

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Accepted Answer

SSL decryption is not enabled for the session.. Options A and D are correct. Option A: Asymmetric routing can cause incomplete because the firewall may only see half the session. Option D: SSL decryption not enabled for encrypted traffic prevents full inspection of the payload. Option B is wrong because policy configuration does not affect classification. Option C is wrong because slow processing does not cause incomplete; it may cause packet drops but not incomplete. Option E is wrong because content-ID is separate and not directly causing incomplete.

Answer

The firewall CPU is too slow to process packets.

Answer

The content-ID engine has not been licensed.

Answer

A deny rule that blocks the traffic.

Question 13

Which THREE attributes can be used in a custom App-ID signature to identify an application? (Choose three.)

Accepted Answer

Protocol (TCP, UDP, etc.). Options A, C, and E are correct. Protocol (A) is the base attribute; data pattern (C) matches payload content; port (E) can define known ports. Option B is incorrect because security policies are not part of signature definition. Option D is incorrect because URL category is for URL filtering, not App-ID signature.

Answer

URL category

Answer

Security policy action

Question 14

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Accepted Answer

Use applications instead of ports in security policies.. Options A and C are correct. Option A: Using application-based policy improves security and flexibility. Option C: Combining App-ID with other security profiles (e.g., content-ID) enables comprehensive inspection. Option B is wrong because disabling App-ID for all traffic defeats the purpose. Option D is wrong because relying solely on ports is not recommended. Option E is wrong because using only well-known applications reduces visibility.

Answer

Disable App-ID for traffic that does not match any known application to improve performance.

Answer

Configure all security policies based on port only for consistency.

Answer

Limit application usage to only well-known applications to reduce attack surface.

Question 15

A security administrator notices that HTTP traffic is correctly identified as web-browsing but HTTPS traffic is showing as ssl. The company uses a custom HTTPS-based application that needs to be identified by its own App-ID. What should the administrator do?

Accepted Answer

Create an App-ID override (custom application) for the custom application.. Option B is correct because creating an App-ID override allows the administrator to define a custom application signature for the traffic, ensuring it is identified as the custom application rather than ssl. Option A is wrong because configuring a custom URL category does not affect App-ID. Option C is wrong because SSL decryption alone does not change the application identity; it only allows inspection. Option D is wrong because disabling App-ID would bypass application identification entirely.

Answer

Enable SSL decryption on the firewall.

Answer

Configure a custom URL category for the application.

Answer

Disable App-ID for the traffic.

PCNSE Securing Traffic and App-ID Practice Test 3 — 15 Questions

Exhibit

PCNSE Securing Traffic and App-ID Practice Test 3 — 15 Questions

Exhibit