PCNSA App-ID and Content-ID Practice Question
A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?
⚠ Common exam trap
Many exam-takers assume an application override alone will make the traffic match an existing rule that allows 'ssl' or 'web-browsing', but the override creates a new App-ID that must be explicitly added to the security rule's application list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security rule that allows the traffic does not include the custom application.
The security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL decryption is not enabled for the custom application.
Why it's wrong here
Decryption is not required for App-ID.
- ✗
The custom application needs to be added to the 'ssl' application group.
Why it's wrong here
Groups are not required.
- ✓
The security rule that allows the traffic does not include the custom application.
Why this is correct
The traffic may be matching a different rule that doesn't have the custom app.
- ✗
The application override was not committed.
Why it's wrong here
Assuming it was committed.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.