PCNSE Securing Traffic and App-ID Practice Test 4 — 15 Questions

Question 1

A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?

Accepted Answer

Create a custom application with a data pattern (signature).. Option C is correct because creating a custom application with a data pattern (e.g., a signature) allows the firewall to identify the proprietary protocol without altering the default engine. Option A is wrong because enabling SSL decryption is not relevant for a proprietary protocol that is not SSL. Option B is wrong because an application override bypasses App-ID entirely. Option D is wrong because using a port override does not improve identification; it only bypasses App-ID.

Answer

Configure a port-based application override for port 4444.

Answer

Enable SSL decryption for the ERP traffic.

Answer

Create an application override to allow the traffic without App-ID.

Question 2

During a security audit, an administrator finds that traffic on TCP port 443 is classified as web-browsing, but the firewall is configured to use SSL decryption. However, the traffic is not decrypted because it uses a self-signed certificate from an internal CA that is not trusted by the firewall. How should the administrator fix this to enable proper App-ID?

Accepted Answer

Import the internal CA certificate and enable SSL forward proxy.. Option A is correct: importing the internal CA certificate and enabling SSL forward proxy with that CA allows the firewall to decrypt traffic using self-signed certificates, enabling App-ID to see the true application. Option B is wrong because disabling SSL decryption for that traffic would prevent identification. Option C is wrong because using SSH decryption is for SSH, not HTTPS. Option D is wrong because a custom App-ID override does not address the decryption issue.

Answer

Configure SSH decryption for the traffic.

Answer

Disable SSL decryption for that traffic and rely on port-based identification.

Answer

Create a custom App-ID override for the application.

Question 3

An administrator wants to apply different security policies for different applications that may use the same IP addresses and ports. Which firewall configuration feature should be used?

Accepted Answer

Security policy with App-ID. Option D is correct: Security policies with App-ID allow you to define rules based on the identified application, enabling different policies for different applications on the same IP/port. Option A is wrong because Application Override bypasses App-ID. Option B is wrong because Decryption policy does not enforce access control. Option C is wrong because QoS only prioritizes traffic, does not filter.

Answer

Application Override

Answer

Quality of Service (QoS) policy

Answer

Decryption policy

Question 4

After upgrading PAN-OS from version 9.1 to 10.0, an administrator notices that traffic for an internal custom application is now classified as unknown-tcp instead of the expected custom application. The application was defined using a custom App-ID in the previous version. What is the most likely cause?

Accepted Answer

The custom App-ID is incompatible with the new version and needs to be re-created.. Option B is correct: Custom App-IDs may not be compatible with the new PAN-OS version and might need to be re-created or updated. Option A is wrong because application signatures are not automatically deprecated without custom App-ID issues. Option C is wrong because the upgrade does not typically reset configurations. Option D is wrong because the license is not directly relevant to App-ID.

Answer

The new version deprecated the application signature.

Answer

The firewall license expired after the upgrade.

Answer

The upgrade reset the firewall configuration.

Question 5

A network administrator wants to ensure that all traffic traversing the firewall is correctly identified by App-ID before any security policies are evaluated. Which step is essential?

Accepted Answer

Ensure App-ID is enabled in the security policy rules.. Option A is correct: App-ID must be enabled in the security policy rule (or globally) to ensure identification occurs before policy evaluation. Option B is wrong because App-ID does not require enabling on interfaces separately. Option C is wrong because zones define traffic boundaries, not App-ID. Option D is wrong because threat prevention is unrelated to App-ID.

Answer

Enable App-ID on the firewall interfaces.

Answer

Configure security zones properly.

Answer

Enable Threat Prevention profiles.

Question 6

An organization uses a SaaS application that runs on a dynamic set of IP addresses. The application traffic is currently identified as ssl and not as the specific application. How can the administrator improve application identification for this SaaS application?

Accepted Answer

Create a custom application with hostname conditions.. Option C is correct: Creating a custom application with hostname conditions (e.g., using SNI) allows the firewall to identify the SaaS application even when IPs change. Option A is wrong because port override bypasses App-ID. Option B is wrong because URL filtering does not affect App-ID. Option D is wrong because disabling App-ID is counterproductive.

Answer

Disable App-ID for that traffic to reduce overhead.

Answer

Use a port-based application override.

Answer

Configure a URL filtering category for the application.

Question 7

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

Accepted Answer

Create a custom application with a hostname condition.. Options A and B are correct: Enabling SSL forward proxy with the internal CA allows decryption to see the SNI, and creating a custom application with a hostname condition uses that SNI for identification. Option C is wrong because disabling App-ID on that port prevents identification. Option D is wrong because an application override bypasses App-ID. Option E is wrong because URL categories do not affect App-ID.

Answer

Disable App-ID on port 8443.

Answer

Use an application override with port 8443.

Answer

Add a custom URL category for the domain.

Question 8

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. Options A, B, and D are correct: An incorrectly configured Application Override policy could misdirect traffic, outdated application signatures may not recognize the custom app, and a non-standard port could cause the custom app to be misidentified as web-browsing. Option C is wrong because SSL decryption is not directly related to misidentification as web-browsing. Option E is wrong because tap mode is not relevant in inline mode.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 9

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Accepted Answer

Set the Service to 'application-default'.. Options A and B are correct: Setting the application to the desired app ensures the rule matches that app, and setting the service to application-default ensures the rule only matches when the app uses its standard port, preventing other apps on the same port from matching. Option C is not specific to application matching. Options D and E are not required for matching.

Answer

Set the Source Zone and Destination Zone.

Answer

Enable Threat Prevention.

Answer

Configure Logging at session start.

Question 10

Refer to the exhibit. An administrator notices that HTTPS traffic to a specific website is being denied. What is the most likely cause?

Accepted Answer

The HTTPS traffic is being identified as web-browsing instead of ssl, so it does not match rule 2 and is denied by rule 3.. Option A is correct: The firewall may identify HTTPS traffic as web-browsing due to a lack of SSL decryption or other factors. Rule 1 allows web-browsing but with service application-default, which expects port 80, not 443. Therefore, HTTPS traffic does not match rule 1, nor rule 2 (since it's identified as web-browsing), and falls to rule 3, which denies. Option B is wrong because rule 2 allows ssl on port 443, but the traffic is not identified as ssl. Option C is wrong because rule 2 does not require other services. Option D is wrong because rule 4 is for trust-to-trust, not trust-to-untrust.

Answer

Rule 2 does not have a service set to application-default, so it cannot match the traffic.

Answer

The traffic is from trust to trust, matching rule 4, but still denied.

Answer

The traffic requires a specific service other than application-default.

Question 11

A large enterprise uses a custom application that communicates over TCP port 8080 using HTTP. The application traffic is correctly identified as 'custom-app' by App-ID. Recently, the development team changed the application to use HTTPS on the same port. The firewall administrator updated the security policy to allow the application, using the same application name, but now the traffic is being denied. The firewall logs show the application as 'ssl' and the action 'deny'. The security policy has a rule that allows 'custom-app' from inside to outside. What should the administrator do to resolve this issue?

Accepted Answer

Update the custom application definition to include SSL decryption and a hostname match.. Option B is correct because the custom application definition was designed for HTTP, not HTTPS. To identify the new HTTPS traffic as the custom application, the administrator must update the definition to include SSL decryption and a hostname match, so that App-ID correctly recognizes the encrypted traffic. Option A is wrong because an override would bypass App-ID, losing visibility. Option C is wrong because allowing all SSL traffic is too broad a security risk. Option D is wrong because disabling App-ID is not a best practice and reduces security.

Answer

Create an application override for the traffic on port 8080.

Answer

Disable App-ID for that traffic and use a port-based policy.

Answer

Change the security policy rule to allow application 'ssl' instead.

Question 12

A managed security service provider (MSSP) manages firewalls for multiple customers. One customer reports that their ERP application traffic is being dropped intermittently. The firewall logs show that the traffic is sometimes identified as 'erp-app' and allowed, and other times identified as 'unknown-tcp' and denied. The ERP application uses a proprietary protocol over TCP port 5555. The firewall has a custom application definition for 'erp-app' that uses a data pattern. The administrator verifies that the data pattern is correct. What should the administrator do to ensure consistent identification?

Accepted Answer

Modify the custom application to include a port condition (default port 5555).. Option D is correct: Adding a port condition to the custom application definition (e.g., setting the default port to 5555) provides a fallback identification mechanism when the data pattern is not detected in a session. This ensures that traffic on port 5555 is consistently identified as 'erp-app'. Option A is wrong because increasing session timeout does not affect identification. Option B is wrong because the protocol is proprietary, not SSL. Option C is wrong because vulnerability protection is for threat prevention, not identification.

Answer

Increase the session timeout for the application.

Answer

Create a vulnerability protection profile to inspect the traffic.

Answer

Enable SSL decryption on the firewall.

Question 13

A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?

Accepted Answer

The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.. Option D is correct: YouTube traffic uses HTTPS, and without SSL decryption, the firewall cannot inspect the URL. Therefore, the URL category condition fails, and the rule does not match. The traffic is then denied by a default deny rule. Option A is wrong because the URL filtering license is required but typically already in place. Option B is wrong because zones are configured. Option C is wrong because application and URL category are ANDed; the issue is decryption, not logic.

Answer

The rule must also specify the source zone.

Answer

The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.

Answer

The URL filtering license is not installed or expired.

Question 14

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

Accepted Answer

The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.. Option C is correct: App-ID may correctly identify most sessions as 'trading-app', but if some sessions have slightly different characteristics (e.g., variations in the protocol), the firewall may fail to identify them and fall back to 'unknown-tcp'. The prior deny rule then blocks those sessions. Option A is wrong because App-ID does not assign multiple identities to the same session. Option B is wrong because the traffic uses the default port. Option D is wrong because no decryption policy is mentioned.

Answer

The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.

Answer

The traffic is using a non-standard port, so the standard rule does not match.

Answer

There is a decryption policy causing the application to be misidentified.

Question 15

Dynamics Inc., a mid-sized company, uses Palo Alto Networks PA-5250 firewalls at their data center. They recently deployed a new web-based CRM application that uses HTTPS and WebSocket connections on TCP port 8443. The security team configured a custom application 'crm-app' with a signature that matches the 'Host' header in HTTP requests, and set the protocol decoder to 'tcp' and the port to 8443. The application is used in a security policy to allow traffic from internal users to the CRM server. However, after deployment, the traffic logs show the application is identified as 'ssl' instead of 'crm-app'. The firewall's App-ID and threat prevention subscriptions are active and up to date. The team has verified that the custom application signature is correctly configured, and the traffic clearly matches the defined host header. Which action should be taken to ensure the CRM traffic is correctly identified by App-ID?

Accepted Answer

Create a new security rule with an application override that sets the application to 'crm-app' for the CRM traffic.. Option B is correct because when App-ID fails to correctly identify traffic despite a properly configured custom application signature, an application override in a security policy can force the identification. This is a supported and common troubleshooting step. Option A is incorrect because disabling SSL decryption would prevent App-ID from inspecting HTTPS headers, making identification less accurate. Option C is incorrect because the timeout parameter controls how long App-ID waits before updating the application, not the initial identification. Option D is incorrect because the protocol decoder and port are already correctly set per the verification; changing them would not resolve the misclassification.

Answer

Increase the 'timeout' value for the custom application signature from 0 to 60 seconds.

Answer

Modify the custom application signature to use the 'tcp' protocol decoder and set the port to 8443.

Answer

Disable SSL decryption for the CRM traffic to allow App-ID to inspect the unencrypted HTTP headers.