PCNSA App-ID and Content-ID Practice Question
A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. The application uses a proprietary protocol on TCP port 8080. What is the most efficient way to ensure correct identification without disabling App-ID?
⚠ Common exam trap
A common mix-up: candidates confuse Application Override (which bypasses App-ID) with a custom App-ID signature (which enhances App-ID), leading them to choose option A because it seems simpler, but it actually disables deep inspection and security controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom App-ID signature for the proprietary protocol.
Creating a custom App-ID signature allows the firewall to correctly identify the proprietary protocol by its unique traffic patterns, such as packet payload signatures or behavioral characteristics, without disabling App-ID. This is the most efficient method as it leverages App-ID's existing classification engine to distinguish the custom application from web-browsing, even though it uses TCP port 8080.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Application Override with the custom application and specify port 8080.
Why it's wrong here
Application Override forces all traffic on that port to be treated as the specified app, risking misidentification.
- ✓
Create a custom App-ID signature for the proprietary protocol.
Why this is correct
Custom App-ID signatures enable accurate identification of non-standard applications.
- ✗
Disable App-ID for that security rule to allow all traffic on port 8080.
Why it's wrong here
Disabling App-ID removes application identification entirely.
- ✗
Create a custom service object for TCP 8080 and add it to a security policy.
Why it's wrong here
Custom service objects only define ports; App-ID still uses default signatures.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.