The correct answer is to create a custom application for the non-standard port and add it to rule1. This is necessary because Palo Alto Networks firewalls use App-ID to identify traffic based on application signatures, not just port numbers; the default 'web-browsing' application is configured to match HTTP on TCP port 80, so traffic on port 8080 is not recognized as matching that application and is subsequently dropped. On the PCNSA exam, this scenario tests your understanding of how App-ID overrides port-based rules—a common trap is assuming that simply opening a port in a security policy will allow the application, when in fact the firewall must first identify the traffic as a known application. A key memory tip is "App-ID first, port second": if the application doesn't match, the traffic is denied even if the port is open. Think of it as the firewall asking "what is this?" before "where is it going?"—without a custom application definition for port 8080, the HTTP traffic remains unidentified and blocked.
PCNSA Securing Traffic Practice Question
This PCNSA practice question tests your understanding of securing traffic. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
security-policy {
rules {
rule1 {
name "Allow-Web";
source-zone "Trust";
destination-zone "Untrust";
source-address "10.0.0.0/24";
destination-address "any";
application "web-browsing";
service "tcp-80";
action "allow";
}
rule2 {
name "Block-All";
source-zone "any";
destination-zone "any";
application "any";
service "any";
action "deny";
}
}
}
Refer to the exhibit. A user from 10.0.0.10 attempts to access an HTTP website hosted on 203.0.113.5 using TCP port 8080. The connection fails. The firewall logs show no session for this traffic. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Refer to the exhibit.
security-policy {
rules {
rule1 {
name "Allow-Web";
source-zone "Trust";
destination-zone "Untrust";
source-address "10.0.0.0/24";
destination-address "any";
application "web-browsing";
service "tcp-80";
action "allow";
}
rule2 {
name "Block-All";
source-zone "any";
destination-zone "any";
application "any";
service "any";
action "deny";
}
}
}
A
Add a new rule before rule1 with application 'web-browsing' and service 'tcp-8080'.
Why wrong: The application 'web-browsing' by default only matches port 80, so it would not identify traffic on port 8080 without a custom application.
B
Remove the service restriction from rule1.
Why wrong: Without service restriction, the rule still requires the application to be identified. Since 'web-browsing' may not identify traffic on port 8080 without a custom app, this change may not resolve the issue and could reduce security.
C
Create a custom application that matches TCP port 8080 and add it to rule1.
A custom application allows App-ID to correctly identify HTTP traffic on non-standard ports, and adding it to the rule allows the traffic.
D
Change the application in rule1 to 'any' to match all applications.
Why wrong: This would allow all applications, not just web traffic, reducing security.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom application that matches TCP port 8080 and add it to rule1.
The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Add a new rule before rule1 with application 'web-browsing' and service 'tcp-8080'.
Why it's wrong here
The application 'web-browsing' by default only matches port 80, so it would not identify traffic on port 8080 without a custom application.
✗
Remove the service restriction from rule1.
Why it's wrong here
Without service restriction, the rule still requires the application to be identified. Since 'web-browsing' may not identify traffic on port 8080 without a custom app, this change may not resolve the issue and could reduce security.
✓
Create a custom application that matches TCP port 8080 and add it to rule1.
Why this is correct
A custom application allows App-ID to correctly identify HTTP traffic on non-standard ports, and adding it to the rule allows the traffic.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Change the application in rule1 to 'any' to match all applications.
Why it's wrong here
This would allow all applications, not just web traffic, reducing security.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume changing the service to 'any' or removing the service restriction will allow the traffic, but they overlook that the application 'web-browsing' still has a default port binding of 80, so the traffic on port 8080 will not be matched by the rule.
Detailed technical explanation
How to think about this question
In Palo Alto Networks firewalls, applications are identified by their unique signatures, not just by port. The 'web-browsing' application is pre-defined to match HTTP traffic on port 80 (and sometimes 443 for HTTPS). When a client uses a non-standard port like 8080, the firewall cannot associate the traffic with the 'web-browsing' application unless a custom application is created that explicitly includes TCP port 8080. This is a common scenario in real-world environments where administrators run HTTP services on alternate ports for testing or legacy reasons.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Securing Traffic — This question tests Securing Traffic — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a custom application that matches TCP port 8080 and add it to rule1. — The firewall rule allows HTTP (port 80) but the client is using TCP port 8080. Since the application is set to 'web-browsing' (which typically matches only port 80), the traffic is not identified as matching that application. Creating a custom application that matches TCP port 8080 and adding it to rule1 allows the firewall to correctly identify and permit the traffic.
What should I do if I get this PCNSA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.