PCNSA App-ID and Content-ID Practice Question
A medium-sized enterprise has deployed a Palo Alto Networks firewall in a branch office. They use App-ID to control access to cloud applications. Recently, they migrated from on-premises Exchange to Office 365. They have a security rule that allows 'office365-base' for all users. However, users report that they cannot access their Office 365 email via Outlook client, although web access works fine. The firewall logs show that the traffic is being allowed as 'office365-base' but no other Office 365 sub-applications are seen. The IT team suspects that App-ID is not fully identifying the Outlook client traffic. What should they do to resolve this issue?
⚠ Common exam trap
It's easy for candidates to assume 'office365-base' covers all Office 365 traffic, but the PCNSA exam tests the understanding that sub-applications must be explicitly allowed for specific client applications like Outlook to function correctly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the existing rule to allow 'office365-base' and other Office 365 sub-applications like 'office365-outlook' and 'office365-exchange'.
The 'office365-base' App-ID only provides basic identification for Office 365 traffic, but Outlook client traffic requires more specific sub-applications like 'office365-outlook' and 'office365-exchange' to be explicitly allowed in the security rule. Without these sub-applications, the firewall may allow the traffic as 'office365-base' but fail to fully identify and permit the Outlook client's proprietary protocols, such as MAPI over HTTP or RPC over HTTPS, which are necessary for email functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL decryption to allow App-ID to identify the Outlook traffic.
Why it's wrong here
Decryption is not necessary for App-ID to identify Office 365.
- ✓
Modify the existing rule to allow 'office365-base' and other Office 365 sub-applications like 'office365-outlook' and 'office365-exchange'.
Why this is correct
Allowing the base app alone is insufficient for full functionality.
- ✗
Create a new rule that allows 'outlook' application specifically.
Why it's wrong here
'outlook' is not the correct app; it's 'office365-outlook'.
- ✗
Change the rule to allow 'office365-base' and set Action to 'allow' with a QoS policy.
Why it's wrong here
QoS does not fix app identification.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.