PCNSA App-ID and Content-ID Practice Question
An organization uses a custom ERP system that communicates over TCP port 4444. The firewall's App-ID incorrectly identifies some of the traffic as 'ssl' because the ERP system uses a proprietary encryption wrapper. What is the recommended approach to ensure correct identification?
⚠ Common exam trap
Candidates often confuse Application Override (which disables App-ID) with a custom App-ID (which enhances App-ID), leading them to choose Option A as a quick fix instead of the more precise and correct solution of creating a custom signature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom App-ID that matches the proprietary encryption wrapper signature.
When App-ID misclassifies traffic due to a proprietary encryption wrapper, the recommended approach is to create a custom App-ID that matches the specific signature of that wrapper. This allows the firewall to correctly identify the application without relying on port-based heuristics or decryption, preserving the integrity of the encrypted session while ensuring accurate policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Application Override to force the ERP application for all traffic on port 4444.
Why it's wrong here
Application Override forces a signature on matching traffic, but it applies to all sessions on port 4444 and disables App-ID inspection for them, so any other application using that port is misclassified. It is tempting because it guarantees the ERP label, and would suit a port carrying only that one application.
- ✗
Enable SSL decryption to inspect the encrypted traffic.
Why it's wrong here
SSL decryption strips TLS to expose the payload, but the ERP wrapper is proprietary, so decryption yields no signature App-ID recognises and the traffic stays misidentified. It is tempting because decryption resolves standard TLS misclassification, and would be correct for traffic using genuine SSL/TLS on non-standard ports.
- ✓
Create a custom App-ID that matches the proprietary encryption wrapper signature.
Why this is correct
A custom App-ID matching the proprietary encryption wrapper's signature lets the firewall identify the ERP traffic by its actual application rather than misclassifying it as ssl. This satisfies the stem's requirement for correct identification of TCP port 4444 traffic, since App-ID inspects payload signatures independently of port.
- ✗
Add a security rule that allows the ERP application object without further configuration.
Why it's wrong here
Adding the ERP application object alone cannot correct misidentification: App-ID has already classified the flow as ssl, so the rule matches the wrong application and the traffic is still inspected as SSL. Application objects are for grouping apps you have already identified correctly, not for overriding a signature-based verdict.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.