PCNSE Securing Traffic and App-ID Practice Test 4 — 15 Questions

Question 1

A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom application with a data pattern (signature).. Creating a custom application with a data pattern (signature) allows the firewall to identify the ERP traffic based on its unique payload characteristics, without overriding or disabling the default App-ID engine. This approach uses a custom App-ID signature that matches the proprietary protocol's data pattern, ensuring accurate identification while the default engine continues to process other traffic normally.

Answer

Configure a port-based application override for port 4444.

Answer

Enable SSL decryption for the ERP traffic.

Answer

Create an application override to allow the traffic without App-ID.

Question 2

During a security audit, an administrator finds that traffic on TCP port 443 is classified as web-browsing, but the firewall is configured to use SSL decryption. However, the traffic is not decrypted because it uses a self-signed certificate from an internal CA that is not trusted by the firewall. How should the administrator fix this to enable proper App-ID?

Accepted Answer

Import the internal CA certificate and enable SSL forward proxy.. The firewall cannot decrypt traffic using a self-signed certificate from an internal CA that is not trusted. By importing the internal CA certificate into the firewall and enabling SSL forward proxy, the firewall can generate a trusted, on-the-fly certificate for the session, allowing it to decrypt the traffic and apply App-ID correctly. Without this, the firewall falls back to port-based identification (TCP 443), which misclassifies the traffic as web-browsing instead of the actual application.

Answer

Configure SSH decryption for the traffic.

Answer

Disable SSL decryption for that traffic and rely on port-based identification.

Answer

Create a custom App-ID override for the application.

Question 3

An administrator wants to apply different security policies for different applications that may use the same IP addresses and ports. Which firewall configuration feature should be used?

Accepted Answer

Security policy with App-ID. App-ID is the correct feature because it enables the firewall to identify and enforce security policies based on the application, regardless of the IP address or port used. This allows different security policies for different applications even when they share the same IP and port, such as HTTP and FTP both using TCP/80.

Answer

Application Override

Answer

Quality of Service (QoS) policy

Answer

Decryption policy

Question 4

After upgrading PAN-OS from version 9.1 to 10.0, an administrator notices that traffic for an internal custom application is now classified as unknown-tcp instead of the expected custom application. The application was defined using a custom App-ID in the previous version. What is the most likely cause?

Accepted Answer

The custom App-ID is incompatible with the new version and needs to be re-created.. When upgrading PAN-OS from version 9.1 to 10.0, custom App-IDs defined in the previous version are not automatically compatible because the internal App-ID framework and signature format changed significantly between these major versions. The custom application definition must be re-created or re-imported using the new version's tools, as the old custom App-ID object becomes orphaned or non-functional, causing traffic to fall back to unknown-tcp.

Answer

The new version deprecated the application signature.

Answer

The firewall license expired after the upgrade.

Answer

The upgrade reset the firewall configuration.

Question 5

A network administrator wants to ensure that all traffic traversing the firewall is correctly identified by App-ID before any security policies are evaluated. Which step is essential?

Accepted Answer

Ensure App-ID is enabled in the security policy rules.. App-ID must be enabled within the security policy rule itself to ensure traffic is identified before policy evaluation. While enabling App-ID on interfaces (Option A) is a prerequisite, the essential step is to configure the security rule to use App-ID as a match criterion; otherwise, the firewall will not perform application identification for that rule. This guarantees that App-ID classification occurs prior to any allow/deny decisions.

Answer

Enable App-ID on the firewall interfaces.

Answer

Configure security zones properly.

Answer

Enable Threat Prevention profiles.

Question 6

An organization uses a SaaS application that runs on a dynamic set of IP addresses. The application traffic is currently identified as ssl and not as the specific application. How can the administrator improve application identification for this SaaS application?

Accepted Answer

Create a custom application with hostname conditions.. App-ID can identify SaaS applications by hostname conditions when the application uses a dynamic set of IP addresses. By creating a custom application with hostname conditions (e.g., matching the FQDN of the SaaS service), the firewall can accurately identify the traffic as that specific application rather than generic SSL, even as the backend IPs change. This leverages the firewall's ability to inspect the Server Name Indication (SNI) field in the TLS handshake or the HTTP Host header.

Answer

Disable App-ID for that traffic to reduce overhead.

Answer

Use a port-based application override.

Answer

Configure a URL filtering category for the application.

Question 7

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

Accepted Answer

Create a custom application with a hostname condition.. A custom application can be defined with a hostname condition to match traffic based on the SNI field in the TLS handshake, which allows App-ID to identify the application even when it uses a non-standard port like 8443. Option E is correct because enabling SSL forward proxy with the internal CA certificate allows the firewall to decrypt the SSL/TLS traffic and inspect the application payload, which is necessary for App-ID to accurately identify the custom application.

Answer

Disable App-ID on port 8443.

Answer

Use an application override with port 8443.

Answer

Add a custom URL category for the domain.

Question 8

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Accepted Answer

The application signature is outdated.. If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Answer

SSL decryption is not enabled.

Answer

The firewall is in tap mode.

Question 9

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Accepted Answer

Set the Service to 'application-default'.. To ensure a security policy rule matches only when a specific application is detected on its standard port, two settings are required: Set the Application to the specific application to match that application's traffic, and set the Service to 'application-default' to restrict matching to the standard port used by that application. This prevents other applications using the same port from triggering the rule. The other options are not directly related to this requirement: Source and Destination zones are necessary for any rule but not specific to application/port matching; Threat Prevention is a separate feature; logging at session start is optional and does not affect matching.

Answer

Set the Source Zone and Destination Zone.

Answer

Enable Threat Prevention.

Answer

Configure Logging at session start.

Question 10

Refer to the exhibit. An administrator notices that HTTPS traffic to a specific website is being denied. What is the most likely cause?

Accepted Answer

The HTTPS traffic is being identified as web-browsing instead of ssl, so it does not match rule 2 and is denied by rule 3.. When App-ID identifies HTTPS traffic as web-browsing (HTTP over port 443) instead of ssl, the traffic does not match rule 2 (which requires the 'ssl' application). Consequently, it falls through to rule 3, which denies the traffic. This misidentification often occurs when the SSL handshake is incomplete or when decryption is not configured, causing the firewall to classify the traffic based on the port rather than the application signature.

Answer

Rule 2 does not have a service set to application-default, so it cannot match the traffic.

Answer

The traffic is from trust to trust, matching rule 4, but still denied.

Answer

The traffic requires a specific service other than application-default.

Question 11

A large enterprise uses a custom application that communicates over TCP port 8080 using HTTP. The application traffic is correctly identified as 'custom-app' by App-ID. Recently, the development team changed the application to use HTTPS on the same port. The firewall administrator updated the security policy to allow the application, using the same application name, but now the traffic is being denied. The firewall logs show the application as 'ssl' and the action 'deny'. The security policy has a rule that allows 'custom-app' from inside to outside. What should the administrator do to resolve this issue?

Accepted Answer

Update the custom application definition to include SSL decryption and a hostname match.. Since the application changed from HTTP to HTTPS on the same port, App-ID now identifies it as 'ssl' instead of 'custom-app' because the traffic is encrypted. To have App-ID recognize the encrypted traffic as the custom application, the administrator must update the custom application definition to include SSL decryption (so the firewall can inspect the encrypted payload) and a hostname match (to distinguish this specific application from other SSL traffic). This allows the existing security policy rule that allows 'custom-app' to match the traffic. Option A is incorrect because an application override would bypass App-ID entirely, reducing visibility and security. Option B is incorrect because disabling App-ID and using port-based policy loses application awareness and security. Option C is incorrect because changing the rule to allow 'ssl' would permit all SSL traffic on port 8080, which is overly permissive and a security risk.

Answer

Create an application override for the traffic on port 8080.

Answer

Disable App-ID for that traffic and use a port-based policy.

Answer

Change the security policy rule to allow application 'ssl' instead.

Question 12

A managed security service provider (MSSP) manages firewalls for multiple customers. One customer reports that their ERP application traffic is being dropped intermittently. The firewall logs show that the traffic is sometimes identified as 'erp-app' and allowed, and other times identified as 'unknown-tcp' and denied. The ERP application uses a proprietary protocol over TCP port 5555. The firewall has a custom application definition for 'erp-app' that uses a data pattern. The administrator verifies that the data pattern is correct. What should the administrator do to ensure consistent identification?

Accepted Answer

Modify the custom application to include a port condition (default port 5555).. The issue is that the custom application 'erp-app' relies solely on a data pattern for identification, but if the first packet of a session does not contain the pattern (e.g., due to TCP segmentation or the pattern appearing later in the flow), App-ID may classify the traffic as 'unknown-tcp' and deny it. By adding a port condition (default port 5555) to the custom application, the firewall will first match the traffic based on the TCP port, then inspect subsequent packets for the data pattern, ensuring consistent identification even if the pattern is not in the initial packet.

Answer

Increase the session timeout for the application.

Answer

Create a vulnerability protection profile to inspect the traffic.

Answer

Enable SSL decryption on the firewall.

Question 13

A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?

Accepted Answer

The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.. When traffic is encrypted (HTTPS), the firewall cannot inspect the URL path or query parameters unless SSL decryption is enabled. Without decryption, URL filtering relies on the Server Name Indication (SNI) or IP address, which may not distinguish between 'youtube' and 'youtube.com/education' traffic. Since the rule requires both the application 'youtube' and the URL category 'educational-videos', the firewall cannot match the URL category for encrypted YouTube traffic, causing all YouTube traffic to be blocked by the implicit deny rule.

Answer

The rule must also specify the source zone.

Answer

The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.

Answer

The URL filtering license is not installed or expired.

Question 14

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

Accepted Answer

The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.. App-ID uses a multi-pass approach: the first packet is classified based on IP/port, but the application may not be fully identified until several packets are inspected. If the trading application uses a dynamic or non-standard handshake, some sessions may not be recognized as 'trading-app' before the security policy is evaluated, causing them to fall back to 'unknown-tcp' and match the deny rule. This sporadic behavior explains why only some sessions are dropped even though the application is eventually identified correctly.

Answer

The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.

Answer

The traffic is using a non-standard port, so the standard rule does not match.

Answer

There is a decryption policy causing the application to be misidentified.

Question 15

Dynamics Inc., a mid-sized company, uses Palo Alto Networks PA-5250 firewalls at their data center. They recently deployed a new web-based CRM application that uses HTTPS and WebSocket connections on TCP port 8443. The security team configured a custom application 'crm-app' with a signature that matches the 'Host' header in HTTP requests, and set the protocol decoder to 'tcp' and the port to 8443. The application is used in a security policy to allow traffic from internal users to the CRM server. However, after deployment, the traffic logs show the application is identified as 'ssl' instead of 'crm-app'. The firewall's App-ID and threat prevention subscriptions are active and up to date. The team has verified that the custom application signature is correctly configured, and the traffic clearly matches the defined host header. Which action should be taken to ensure the CRM traffic is correctly identified by App-ID?

Accepted Answer

Create a new security rule with an application override that sets the application to 'crm-app' for the CRM traffic.. When a custom application signature fails to identify traffic due to the firewall's inability to inspect encrypted payloads (like HTTPS/WebSocket), an application override in a security rule forces App-ID to classify the traffic as the specified application regardless of the signature match. Since the CRM traffic uses HTTPS on port 8443, the firewall sees encrypted SSL/TLS handshakes and defaults to 'ssl' App-ID because it cannot inspect the encrypted HTTP headers. An application override bypasses the App-ID identification process and directly assigns the desired application, ensuring correct logging and policy enforcement.

Answer

Increase the 'timeout' value for the custom application signature from 0 to 60 seconds.

Answer

Modify the custom application signature to use the 'tcp' protocol decoder and set the port to 8443.

Answer

Disable SSL decryption for the CRM traffic to allow App-ID to inspect the unencrypted HTTP headers.