PCNSA App-ID and Content-ID Practice Question
An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)
⚠ Common exam trap
The trap here is that candidates mistakenly think blocking common ports (Option B) is sufficient, but the exam tests the understanding that App-ID is application-aware and port-independent, making application-based blocking the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security rule with the application and action 'deny'.
App-ID identifies traffic based on application signatures, not just ports. By creating a security rule with the specific application and setting the action to 'deny', the firewall blocks all traffic matching that application regardless of the ports or protocols it uses. This is the most precise and effective method to block an application that uses multiple ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a security rule with the application and action 'deny'.
Why this is correct
Denying the application blocks all its traffic.
- ✗
Block the common ports used by the application.
Why it's wrong here
The application may use other ports.
- ✗
Disable App-ID on the zone to prevent inspection.
Why it's wrong here
This would not block the application specifically.
- ✗
Create a security rule allowing the application but with a limit.
Why it's wrong here
Allowing the application would not block it.
- ✓
Use an Application Override to categorize the traffic and then block it.
Why this is correct
Application Override allows blocking based on override.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.