easyMultiple ChoiceObjective-mapped
PCNSA Practice Question: A network administrator is migrating from a…
A network administrator is migrating from a legacy firewall to a new Palo Alto Networks firewall. The current firewall has a large number of ACL rules that allow traffic based on source/destination IP and port. The administrator wants to convert these rules to App-ID based policies on the Palo Alto firewall. What is the recommended best practice to ensure a smooth migration while maintaining security?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the same port-based rules on the Palo Alto firewall and then gradually enable App-ID in learning mode to see what applications are being used.
The recommended best practice for migrating from legacy firewall rules to App-ID based policies is to first replicate the existing port-based rules on the Palo Alto firewall to ensure no disruption to traffic. Then, enable App-ID in learning mode (or 'log and learn') to observe the actual applications being used. This allows the administrator to identify applications without blocking them. After sufficient data is collected, the administrator can create App-ID based policies. Option A is incorrect because Policy Optimizer is used for optimization after migration, not as the first step. Option B is risky as it leaves no security policies. Option D could cause outages by immediately enforcing App-ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Policy Optimizer feature in Panorama to analyze existing logs and generate App-ID based policy recommendations.
Why it's wrong here
Policy Optimizer is useful after migration to optimize policies, but the first step should be to ensure connectivity and visibility.
- ✗
Deploy the Palo Alto firewall inline with no policies first, and let it learn the traffic patterns automatically for a week.
Why it's wrong here
Without any security policies, all traffic would be allowed, which is a security risk; also, the firewall cannot automatically learn policies.
- ✓
Create the same port-based rules on the Palo Alto firewall and then gradually enable App-ID in learning mode to see what applications are being used.
Why this is correct
This ensures no loss of connectivity and provides visibility into applications before switching to App-ID based policies, minimizing risk.
- ✗
Convert all existing rules to App-ID by using the application default ports and immediately enforce application blocking.
Why it's wrong here
Immediate enforcement without visibility could block legitimate traffic that uses non-standard ports or unexpected applications.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.