PCNSA App-ID and Content-ID Practice Question
A network security engineer at a large enterprise is troubleshooting an issue where web traffic (HTTP and HTTPS) from the corporate LAN to the internet is being incorrectly classified by the Palo Alto Networks firewall. The firewall is running PAN-OS 10.2. The security policy has an App-ID based rule that allows 'web-browsing' and 'ssl' applications to the internet. However, legitimate web traffic is being blocked by a different rule that denies 'unknown-tcp' traffic. The engineer has verified that the firewall has internet connectivity and that the SSL decryption is not configured. The engineer also confirmed that the application override is not configured for any of the affected IPs. What is the most likely reason for the misclassification, and what action should the engineer take to resolve the issue?
⚠ Common exam trap
Watch out — candidates often assume App-ID can always identify HTTPS traffic as 'ssl' without decryption, but they overlook that incomplete handshakes or missing initial packets cause the firewall to classify the traffic as 'unknown-tcp', leading to incorrect rule matches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.
The firewall's App-ID relies on decoding the initial packets of a session to identify the application. Without SSL decryption, HTTPS traffic appears as encrypted payload, which App-ID cannot decode, often resulting in classification as 'ssl' (if the handshake is recognized) or 'unknown-tcp' if the handshake is incomplete or not fully parsed. The engineer should review the App-ID logs for 'incomplete' or 'not-applicable' status, and enabling SSL decryption or updating the certificate chain would allow the firewall to inspect the encrypted traffic and correctly identify it as 'web-browsing' or 'ssl'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure User-ID and enable User-ID mapping for the web traffic.
Why it's wrong here
User-ID is for identifying users, not for application classification. It would not resolve the misidentification.
- ✓
Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.
Why this is correct
App-ID may fail to decode the traffic if the SSL handshake fails or the certificate is not trusted. This leads to 'unknown-tcp' classification. Enabling SSL decryption or ensuring proper certificate chains can resolve this.
- ✗
Disable all application security profiles for the affected traffic to allow the firewall to classify based on port only.
Why it's wrong here
Disabling security profiles does not affect application identification; it only reduces inspection. It would not fix the classification issue.
- ✗
Create custom App-ID signatures for the web servers.
Why it's wrong here
Custom App-IDs are not needed for standard web traffic; the built-in signatures should work.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.