hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: A multinational company has deployed a Palo Alto…
A multinational company has deployed a Palo Alto Networks firewall in a datacenter to provide internet access to employees in the corporate office and remote branches via IPsec VPN. The firewall is configured with multiple virtual routers, security zones (trust, untrust, dmz, vpn), and policies for application and URL filtering. Recently, users in the corporate office report that they cannot access a critical cloud-based CRM application (https://crm.company.com) from their workstations, while access from remote VPN users works fine. Other websites are accessible from the corporate office. The IT team has verified that DNS resolution is correct and that the CRM server responds to pings from the firewall's management IP. The security policy includes a rule from trust to untrust that allows application 'crm-base' and 'ssl' with URL category 'crm-sites'. The administrator has checked the traffic logs and sees that sessions are being denied with the reason 'application mismatch'. Which of the following is the most likely cause and correct course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.
The application mismatch error indicates that the firewall's App-ID is not correctly identifying the CRM traffic as 'crm-base'. This could be because the application signatures are outdated, or the CRM application uses protocols or patterns not fully captured by the current App-ID. The correct course of action is to update the application and threat signatures to the latest version. If the issue persists, the administrator should expand the security policy to include a fallback application (like 'ssl' or 'web-browsing') or create a custom App-ID to correctly identify the traffic. Option B is incorrect because SSL decryption would help inspect encrypted traffic but is not the direct cause of application mismatch; the issue is identification, not decryption. Option C is incorrect because using 'web-browsing' would be too broad and weaken security. Option D is incorrect because the destination address is correctly set; the issue is with application identification on the firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Update the application and threat signatures to the latest version, and verify that the application 'crm-base' correctly identifies the CRM traffic. If not, expand the policy to include a fallback application or use custom App-ID.
Why this is correct
Keeping signatures updated ensures proper application identification. If the application is still not recognized, using a broader application (like 'ssl' with URL category) or creating a custom App-ID can resolve the mismatch.
- ✗
Enable SSL decryption to inspect the traffic and improve application identification.
Why it's wrong here
Decryption helps identify applications, but the mismatch may persist if the application signature is outdated; also, decryption adds overhead. It is not the most direct fix.
- ✗
Modify the security policy to allow application 'web-browsing' instead of 'crm-base' and 'ssl'.
Why it's wrong here
Allowing 'web-browsing' is too permissive and may allow unintended traffic, violating security posture.
- ✗
Check that the destination address object for the CRM server is correct and includes the CDN IPs.
Why it's wrong here
Destination address does not affect application identification; the issue is application mismatch, not routing.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.