hardMultiple Choice
PCNSA Practice Question: A multinational company has deployed a Palo Alto…
A multinational company has deployed a Palo Alto Networks firewall in a datacenter to provide internet access to employees in the corporate office and remote branches via IPsec VPN. The firewall is configured with multiple virtual routers, security zones (trust, untrust, dmz, vpn), and policies for application and URL filtering. Recently, users in the corporate office report that they cannot access a critical cloud-based CRM application (https://crm.company.com) from their workstations, while access from remote VPN users works fine. Other websites are accessible from the corporate office. The IT team has verified that DNS resolution is correct and that the CRM server responds to pings from the firewall's management IP. The security policy includes a rule from trust to untrust that allows application 'crm-base' and 'ssl' with URL category 'crm-sites'. The administrator has checked the traffic logs and sees that sessions are being denied with the reason 'application mismatch'. Which of the following is the most likely cause and correct course of action?
⚠ Common exam trap
The trap is assuming that SSL decryption is always needed for application identification, but in this case, the mismatch is likely due to outdated signatures or the application not being correctly identified, so updating signatures and adjusting the policy is the first step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.
The 'application mismatch' denial indicates that the firewall's App-ID engine identified the traffic as a different application than the one allowed in the security policy. This can occur if the application signature is outdated or if the traffic pattern does not match the expected 'crm-base' application. Updating signatures and potentially adding a fallback application or custom App-ID is the correct course of action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.
Why this is correct
'Application mismatch' means App-ID identified the session as something other than crm-base, usually because signatures are stale or the SaaS app has changed. Refreshing signatures, then adding a fallback or custom App-ID, restores the trust-to-untrust match.
- ✗
Enable SSL decryption to inspect the traffic and improve application identification.
Why it's wrong here
Decryption cannot resolve an application mismatch, since the firewall already identified the session and the policy simply omits the detected application. It is tempting because decryption improves App-ID visibility, and would be correct where encrypted traffic is classified only as ssl.
- ✗
Modify the security policy to allow application 'web-browsing' instead of 'crm-base' and 'ssl'.
Why it's wrong here
Allowing web-browsing replaces the specific application with a broad one, contradicting the mismatch rather than adding the detected application. It is tempting because web-browsing often accompanies ssl, and would be correct for general internet access, not a sanctioned CRM app.
- ✗
Check that the destination address object for the CRM server is correct and includes the CDN IPs.
Why it's wrong here
Incorrect destination addresses would deny on policy match or routing, not report application mismatch; the firewall already identified the application. It is tempting because CDN address objects commonly cause connectivity faults, and would be correct if logs showed incomplete or no App-ID.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.