PCNSA App-ID and Content-ID Practice Question
A security administrator wants to block all peer-to-peer file sharing applications while allowing web browsing. Which type of security policy rule should they configure?
⚠ Common exam trap
The trap here is assuming that blocking specific ports or websites is sufficient to stop peer-to-peer file sharing, when P2P applications can use evasive techniques and require App-ID for accurate control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An application-based rule that denies the 'peer-to-peer' application group.
An application-based security policy rule using App-ID can identify and block the 'peer-to-peer' application group, which includes known P2P file sharing applications. This approach is effective regardless of the ports or protocols used. Service-based rules are port-dependent and easily bypassed. URL filtering and decryption rules do not directly block P2P applications. Thus, the application-based rule is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A URL filtering rule that blocks P2P websites.
Why it's wrong here
URL filtering blocks access to websites based on URL categories, but it does not control the P2P application traffic itself. Users could still use P2P clients that connect to trackers or peers directly. Therefore, URL filtering alone does not block all P2P file sharing.
- ✗
A decryption rule that blocks encrypted P2P traffic.
Why it's wrong here
A decryption rule controls SSL/TLS decryption, not application blocking. While it could decrypt P2P traffic for inspection, it does not inherently block it. The requirement is to block P2P, so a security policy rule with App-ID is needed, not a decryption rule.
- ✓
An application-based rule that denies the 'peer-to-peer' application group.
Why this is correct
Application-based rules use App-ID to identify applications regardless of port or protocol. The 'peer-to-peer' application group contains known P2P applications. Denying this group effectively blocks all peer-to-peer file sharing while allowing other applications like web browsing, as long as the rule is placed appropriately.
- ✗
A service-based rule that denies TCP ports 6881-6889.
Why it's wrong here
Service-based rules rely on port numbers, but P2P applications can use dynamic ports or masquerade on common ports like 80. Blocking specific ports may not block all P2P traffic and could inadvertently block legitimate services. App-ID is needed to reliably identify P2P applications.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.