PCNSA App-ID and Content-ID Practice Question
A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?
⚠ Common exam trap
Many candidates assume a commit immediately updates all traffic, but Palo Alto Networks firewalls only apply App-ID changes to new sessions, not existing ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.
App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire. Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall needs to have Application Override enabled for the custom signature to work.
Why it's wrong here
Application Override is not required; custom signatures work natively.
- ✗
The firewall must be restarted to apply the new custom signature.
Why it's wrong here
A commit is sufficient; restart is unnecessary.
- ✓
The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.
Why this is correct
App-ID updates identification for new sessions; existing sessions continue with previous identification.
- ✗
The signature must be imported from the Palo Alto Networks application database.
Why it's wrong here
Custom signatures are created locally and do not require import.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.