PCNSA App-ID and Content-ID Practice Question
A financial services company uses a Palo Alto Networks firewall to protect its customer data. They have a requirement to block all file transfers that contain credit card numbers (PCI compliance). The firewall has Data Filtering profiles configured to detect credit card patterns. However, the security team notices that some file transfers containing credit card numbers are not being blocked. The traffic logs show the applications are identified correctly, and the security rule has the Data Filtering profile attached. The Data Filtering profile is configured with a rule to block 'Credit Card Numbers' with a threshold of 1. What could be the issue?
⚠ Common exam trap
Many candidates assume attaching a Data Filtering profile to a security rule automatically applies it to all traffic matching the rule, but the profile itself has an application filter that must include the specific applications being used for the transfer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Data Filtering profile does not include the specific applications that are transferring files.
Data Filtering profiles are applied per application. If the specific applications used for file transfers (e.g., custom or less common apps) are not selected within the Data Filtering profile, the firewall will not inspect those transfers for credit card numbers, even if the security rule has the profile attached. The profile must explicitly include the applications to enforce the data filtering rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Data Filtering profile does not include the specific applications that are transferring files.
Why this is correct
Data Filtering profiles must specify which applications to inspect; if the application is not listed, no filtering occurs.
- ✗
The Data Filtering profile is not attached to the security rule.
Why it's wrong here
It is attached, otherwise traffic would not be filtered at all.
- ✗
The security rule is not logging the Data Filtering alerts.
Why it's wrong here
Logging would not affect blocking.
- ✗
SSL decryption is not enabled for the traffic.
Why it's wrong here
Data Filtering can inspect decrypted traffic, but it also works on plaintext; encrypted traffic needs decryption.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.