PCNSA App-ID and Content-ID Practice Question
An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)
⚠ Common exam trap
The trap here is that candidates mistakenly think blocking common ports (Option B) is sufficient, but the exam tests the understanding that App-ID is application-aware and port-independent, making application-based blocking the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security rule with the application and action 'deny'.
Option A is correct because a security rule that references the application by name (via App-ID) and sets the action to 'deny' blocks all traffic identified as that application regardless of which ports it uses, which is exactly what is needed for a multi-port application. Option E is correct because an Application Override policy lets the firewall reclassify traffic on specified ports as a known application, after which a security rule can deny that application, providing a way to block traffic that App-ID might not otherwise identify across its multiple ports. Option B is not ideal because blocking only the common ports leaves the application free to use other ports, so it does not reliably block all traffic from the application. Option C is wrong because disabling App-ID removes the ability to identify and control the application by name. Option D is wrong because allowing the application with a limit still permits traffic rather than blocking it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a security rule with the application and action 'deny'.
Why this is correct
App-ID identifies the application regardless of port, so a security rule referencing that application with a deny action blocks all its traffic across every port it uses. This satisfies the requirement without enumerating individual ports.
- ✗
Block the common ports used by the application.
Why it's wrong here
Blocking the known ports fails because the application shifts to other ports, and port-based rules cannot identify it. App-ID classifies the application itself, so a single deny rule covers every port. Port blocking suits legacy fixed-port services where no application identification exists.
- ✗
Disable App-ID on the zone to prevent inspection.
Why it's wrong here
Disabling App-ID stops the firewall inspecting traffic, so no application can be identified or blocked at all. App-ID is what lets one rule match an application regardless of port. Disabling inspection suits troubleshooting or trusted high-throughput zones, not enforcement.
- ✗
Create a security rule allowing the application but with a limit.
Why it's wrong here
An allow rule with a limit still permits the application's traffic, so nothing is blocked; rate limiting only caps session counts. It would suit throttling a bandwidth-heavy but permitted application. Blocking requires a deny rule matching the application's App-ID, which identifies it across every port it uses.
- ✓
Use an Application Override to categorize the traffic and then block it.
Why this is correct
An Application Override forces traffic on specified ports to be classified as a chosen application, letting App-ID recognise custom or multi-port traffic. A security rule can then deny that overridden application, blocking all its traffic.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.