PCNSA App-ID and Content-ID Practice Question
An organization uses a custom ERP system that communicates over TCP port 4444. The firewall's App-ID incorrectly identifies some of the traffic as 'ssl' because the ERP system uses a proprietary encryption wrapper. What is the recommended approach to ensure correct identification?
⚠ Common exam trap
Candidates often confuse Application Override (which disables App-ID) with a custom App-ID (which enhances App-ID), leading them to choose Option A as a quick fix instead of the more precise and correct solution of creating a custom signature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom App-ID that matches the proprietary encryption wrapper signature.
When App-ID misclassifies traffic due to a proprietary encryption wrapper, the recommended approach is to create a custom App-ID that matches the specific signature of that wrapper. This allows the firewall to correctly identify the application without relying on port-based heuristics or decryption, preserving the integrity of the encrypted session while ensuring accurate policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Application Override to force the ERP application for all traffic on port 4444.
Why it's wrong here
Application Override can lead to misidentification if other traffic uses the same port.
- ✗
Enable SSL decryption to inspect the encrypted traffic.
Why it's wrong here
SSL decryption cannot reclassify the application; it only decrypts traffic.
- ✓
Create a custom App-ID that matches the proprietary encryption wrapper signature.
Why this is correct
Custom App-ID signatures can identify applications based on payload patterns.
- ✗
Add a security rule that allows the ERP application object without further configuration.
Why it's wrong here
Without correct identification, the rule will not match traffic.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.