PCNSA App-ID and Content-ID Practice Question
A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?
⚠ Common exam trap
Test-takers frequently assume SSL decryption is mandatory for sub-application identification, but App-ID can leverage unencrypted metadata (like SNI and DNS) to classify sub-applications without decryption, making option B a common distractor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic lacks enough signatures to identify the sub-application.
App-ID uses a multi-layered approach to identify applications, including signatures, SSL decryption, and behavioral analysis. When YouTube traffic is classified as 'youtube-base' instead of the more specific 'youtube-streaming', it indicates that the firewall has identified the base application (YouTube) but lacks sufficient signatures or heuristics to differentiate the streaming sub-application. This typically occurs when the traffic does not contain enough distinct patterns (e.g., specific HTTP headers, TLS SNI, or packet sizes) to trigger the sub-application signature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall has not received the latest App-ID update.
Why it's wrong here
App identification is done locally; updates add new apps but do not affect existing ones.
- ✗
SSL decryption is not configured.
Why it's wrong here
YouTube is identified without decryption.
- ✓
The traffic lacks enough signatures to identify the sub-application.
Why this is correct
If only partial identification is possible, it shows as the parent app.
- ✗
A security rule is blocking the sub-application.
Why it's wrong here
If blocked, traffic would be denied, not reclassified.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.