Knowledge + Practice

CCNA App-ID and Content-ID Questions

50 questions · App-ID and Content-ID · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

A.BitTorrent is not part of the peer-to-peer application category.

B.The security rule is using an application group instead of an application filter.

C.The firewall does not have the latest App-ID update and cannot identify BitTorrent.

D.The rule is placed after an allow rule that matches the traffic.

AnswerD

Palo Alto Networks evaluates security rules top-down and stops at the first match. An allow rule positioned above the peer-to-peer deny rule matches the BitTorrent session first, so the deny rule is never evaluated despite correct zones, category and any/any scope.

Why this answer

In Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Exam trap

The trap here is that candidates often focus on App-ID configuration details (like categories or updates) and overlook the fundamental concept of rule ordering, which is a common cause of policy bypass in firewall management.

How to eliminate wrong answers

Option A is wrong because BitTorrent is indeed classified under the 'peer-to-peer' application category in Palo Alto Networks App-ID, so the category should match. Option B is wrong because the question states the rule includes the 'peer-to-peer category', which can be applied via an application filter or group; using an application group would still work if it contains the correct applications, but the issue is rule ordering, not the method of application selection. Option C is wrong because the traffic logs show the application as 'bittorrent', meaning App-ID has successfully identified it; a missing update would result in 'incomplete' or 'unknown' application identification, not a correctly identified application that fails to match.

Practice this question →

2

MCQmedium

A security administrator notices that a Security policy rule permitting the application 'ssl' also allows users to access unauthorized SaaS applications that tunnel their traffic inside TLS on TCP 443. The administrator wants to block these applications without disrupting legitimate TLS traffic. Which Palo Alto Networks feature should be used to identify and control these applications?

A.QoS policy to rate-limit traffic on port 443

B.Application Override policy to force traffic to a custom application

C.URL Filtering profile to block the SaaS applications by their web categories

D.SSL Decryption with a Forward Proxy certificate and a Decryption policy

AnswerD

SSL Decryption with a Forward Proxy certificate allows the firewall to decrypt TLS traffic, enabling App-ID to identify applications tunneled inside SSL. A Decryption policy defines which traffic to decrypt based on URL categories, source/destination, and other criteria. Once decrypted, Security policy rules can block the specific SaaS applications while permitting legitimate TLS traffic, directly addressing the unauthorized access described.

Why this answer

The unauthorized SaaS applications are hidden inside TLS, so App-ID alone cannot see them. SSL Decryption with a Forward Proxy certificate allows the firewall to decrypt the traffic, after which App-ID can identify the actual applications. A Decryption policy determines what to decrypt, and Security policy can then block the specific SaaS applications while allowing legitimate TLS.

This combination provides granular control without disrupting all TLS traffic.

Exam trap

The trap here is assuming that App-ID can identify applications inside encrypted TLS without decryption, or that URL Filtering can see URLs in encrypted traffic.

Practice this question →

3

MCQeasy

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

A.Use URL Filtering to block BitTorrent.

B.Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.

C.Use Data Filtering to block BitTorrent traffic.

D.Block the commonly used ports for BitTorrent.

AnswerB

Palo Alto Networks App-ID identifies BitTorrent by its traffic characteristics rather than port, so a security rule matching the bittorrent application with a Deny action blocks the protocol even when it uses non-standard or randomised ports.

Why this answer

Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Exam trap

The trap here is that candidates often default to port-based blocking (Option D) or think URL Filtering (Option A) can block application traffic, failing to recognize that App-ID is the only method that can identify and block applications like BitTorrent irrespective of port or encryption.

How to eliminate wrong answers

Option A is wrong because URL Filtering is designed to block access to specific websites or URL categories, not to identify or block application-layer protocols like BitTorrent. Option C is wrong because Data Filtering is used to block or alert on sensitive data patterns (e.g., credit card numbers) within allowed traffic, not to block entire application protocols. Option D is wrong because BitTorrent can dynamically use any port (including port 80 or 443) to evade simple port-based blocking, making port-based rules ineffective.

Practice this question →

4

MCQhard

A security administrator is configuring a File Blocking profile to prevent users from downloading executable files from the internet. The administrator wants to ensure that the firewall blocks only the download direction and not the upload direction, while still logging the event. Which configuration should be used?

A.Set the File Blocking profile action to 'block' for all file types in the download direction.

B.Set the File Blocking profile action to 'alert' for the 'exe' file type in both directions.

C.Set the File Blocking profile action to 'continue' for the 'exe' file type in the upload direction only.

D.Set the File Blocking profile action to 'block' for the 'exe' file type in the download direction only.

AnswerD

File Blocking profiles allow you to specify the action (block, alert, continue) per file type and direction. Setting 'block' for 'exe' in the download direction ensures that executable files are blocked when downloaded, while uploads are not affected. Logging is automatically generated for blocked files, satisfying the logging requirement. This directly meets the administrator's needs without overblocking.

Why this answer

A File Blocking profile can be configured with specific actions per file type and direction. To block only executable downloads while logging, the action for 'exe' should be set to 'block' in the download direction. This prevents executable files from being downloaded, logs the event, and leaves uploads and other file types unaffected.

This precise configuration meets the security requirement without unnecessary restrictions.

Exam trap

The trap here is confusing the 'alert' and 'continue' actions with 'block', or applying the block to all file types or both directions.

Practice this question →

5

MCQmedium

A security administrator at a healthcare company needs to detect and block outbound emails that contain patient Social Security numbers. The company uses Microsoft Exchange over SMTP, and the firewall is running PAN-OS 10.1 with the appropriate subscriptions. Which Content-ID feature should the administrator configure to inspect the email body and attachments for sensitive data patterns?

A.Data Filtering profile

B.Antivirus security profile

C.File Blocking profile

D.URL Filtering profile

AnswerA

Data Filtering profiles use predefined or custom data patterns to detect sensitive information such as Social Security numbers within allowed traffic. Applied to a security rule, the profile inspects the payload of email protocols like SMTP and can alert, block, or log when patterns match. This directly addresses the requirement to prevent outbound emails containing patient SSNs.

Why this answer

Data Filtering profiles are designed to detect and control sensitive information such as credit card numbers, Social Security numbers, and custom patterns within allowed traffic. When applied to a security rule that permits SMTP, the firewall inspects the email body and attachments for these patterns and can block or alert. This is the correct Content-ID feature for preventing outbound emails with patient SSNs.

Exam trap

The trap here is confusing data loss prevention with file type control, assuming that blocking certain file types or scanning for malware will also detect sensitive data patterns in email content.

Practice this question →

6

MCQeasy

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

A.URL Filtering Profile

B.Application Override

C.File Blocking Profile

D.Data Filtering Profile

AnswerD

Data Filtering profiles inspect content streams for predefined patterns such as credit card numbers, then block or alert on detection. This directly satisfies the requirement to stop card numbers leaving through webmail, unlike antivirus or URL filtering, which examine files and destinations rather than data patterns.

Why this answer

Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Exam trap

The trap here is that candidates often confuse Data Filtering with File Blocking, assuming that blocking file attachments is sufficient to prevent data loss, but Data Filtering is specifically designed to inspect and block sensitive text patterns within the body of webmail or other application traffic.

How to eliminate wrong answers

Option A is wrong because URL Filtering Profile controls access to websites based on URL categories and reputation, not the content within webmail messages. Option B is wrong because Application Override is used to force a specific application signature for traffic that is not correctly identified, not to inspect or filter data content. Option C is wrong because File Blocking Profile blocks specific file types (e.g., .exe, .zip) based on file name or type, but it cannot inspect the body of an email for patterns like credit card numbers.

Practice this question →

7

MCQmedium

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

A.The firewall is not connected to the cloud for App-ID updates.

B.The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.

C.Decryption is not enabled for Google Drive traffic.

D.An application override is configured for Google Drive.

AnswerB

Google Drive uploads traverse a distinct App-ID signature, 'google-drive-upload', separate from 'google-drive-base'. Since the security rule permits only the base application, the upload session matches no allow rule and is denied by the implicit interzone default. App-ID identifies each function independently, so both signatures must be permitted for full access.

Why this answer

App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

Exam trap

The trap here is that candidates assume a single application signature like 'google-drive-base' covers all traffic for that application, but Palo Alto Networks App-ID often splits applications into multiple sub-application signatures for granular control, and failing to allow the specific sub-application for uploads will result in blocked traffic.

How to eliminate wrong answers

Option A is wrong because App-ID updates are not required for the firewall to recognize Google Drive sub-applications; the signatures are already present in the initial App-ID database and are updated via dynamic updates, but the issue here is a policy misconfiguration, not a connectivity problem. Option C is wrong because decryption is not a prerequisite for App-ID to identify Google Drive traffic; App-ID can identify applications using unencrypted metadata and heuristics, and while decryption improves accuracy, its absence does not cause a specific 'google-drive-upload' signature to be blocked if the rule allows only 'google-drive-base'. Option D is wrong because an application override would replace App-ID identification with a static application definition, which would not cause a selective block of uploads; instead, it would either allow or block all Google Drive traffic based on the override, not differentiate between base and upload functions.

Practice this question →

8

MCQmedium

A security administrator is configuring a Security policy rule to allow access to a SaaS application. The administrator wants to ensure that the application is identified correctly even if it uses dynamic IP addresses and multiple ports. Which App-ID characteristic allows the firewall to identify the application regardless of IP address and port?

A.App-ID uses protocol and behavior-based signatures that are independent of IP addresses and ports.

B.App-ID uses port-based identification for known applications and falls back to signature-based identification for unknown ones.

C.App-ID requires the administrator to manually define the IP addresses and ports for each SaaS application in a custom application object.

D.App-ID relies on a dynamic IP address list that is updated by Palo Alto Networks to track SaaS providers.

AnswerA

App-ID identifies applications by analyzing their protocol characteristics, payload patterns, and behavior, not by IP addresses or ports. This allows the firewall to correctly identify applications even when they use dynamic IPs or non-standard ports. For SaaS applications, App-ID can also use TLS SNI and certificate information. This decoupling from network-layer attributes is a core strength of App-ID.

Why this answer

App-ID identifies applications by their unique protocol and behavioral signatures, independent of IP addresses and ports. This allows the firewall to recognize applications even when they use dynamic IPs or non-standard ports. For SaaS applications, App-ID can also leverage TLS SNI and certificate information.

Relying on IP lists or port-based identification would be ineffective because these attributes change frequently. Therefore, the protocol and behavior-based signature approach is the correct characteristic.

Exam trap

The trap here is assuming that App-ID depends on IP addresses or ports, when it actually uses deep packet inspection and behavioral signatures that are agnostic to network-layer details.

Practice this question →

9

MCQhard

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

A.The application 'webapp' is not allowed due to an application override.

B.SSL decryption is not enabled.

C.A file blocking profile is blocking the upload.

D.App-ID is not identifying the application correctly.

AnswerC

With Content-ID enabled, the firewall inspects the upload and a file blocking profile applied to the matching rule drops the transfer if the file type is blocked. The application itself is permitted, so the file blocking profile is the likely cause.

Why this answer

A file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

Exam trap

The trap here is that candidates often assume the issue is with App-ID misidentification or SSL decryption, but the question explicitly states the application is allowed and Content-ID is enabled, pointing directly to a file blocking profile as the cause of the upload failure.

How to eliminate wrong answers

Option A is wrong because an application override would explicitly allow or deny the application, but the rule already allows 'webapp', so an override would not cause a block unless it was set to deny, which is not indicated. Option B is wrong because SSL decryption is not required for file uploads to a custom web application unless the traffic is encrypted and App-ID or Content-ID needs to inspect the payload; the question does not mention HTTPS, so lack of decryption is not the most likely cause. Option D is wrong because App-ID is correctly identifying the application as 'webapp' (since the rule allows it), and Content-ID is enabled, so the issue is not with identification but with a security profile blocking the upload.

Practice this question →

10

Multi-Selecthard

Which THREE are valid components of Content-ID? (Choose three.)

Select 3 answers

A.Application Filters

B.Application Override

C.URL Filtering

D.File Blocking

E.Data Filtering

AnswersC, D, E

URL Filtering is a core Content-ID component, inspecting web requests against URL categories and threat databases to enforce acceptable-use policy. It satisfies the stem's requirement for a valid Content-ID service alongside file blocking and data filtering, controlling user web access inline on the firewall.

Why this answer

Content-ID is Palo Alto Networks' integrated threat and content inspection engine, and its valid components include URL Filtering (C), which classifies and controls web traffic by URL category; File Blocking (D), which detects and blocks file transfers based on file type and direction; and Data Filtering (E), which inspects traffic for sensitive data patterns such as credit card or Social Security numbers. These three are all profile types configured under Content-ID and applied in security policy to inspect allowed traffic. Application Filters (A) and Application Override (B) are not Content-ID components: Application Filters are used within App-ID to dynamically group applications by characteristics (category, subcategory, technology, risk, etc.), and Application Override is a policy rule that forces specific traffic to be identified as a specified application, bypassing standard App-ID inspection.

Both belong to the App-ID/policy framework rather than the Content-ID inspection engine.

Exam trap

PCNSA often tests the boundary between App-ID and Content-ID — candidates mistakenly include Application Filters or Application Override as Content-ID components when those belong to App-ID.

Practice this question →

11

MCQmedium

A security administrator notices that a SaaS application is allowed by the security policy, but the firewall is not decrypting the traffic. Without decryption, which Content-ID feature can still identify and control the application's use based on the server certificate?

A.Certificate-based App-ID

B.SSL Decryption profile

C.File Blocking profile

D.Data Filtering profile

AnswerA

Certificate-based App-ID allows the firewall to identify applications by inspecting the server certificate during the TLS handshake, even when traffic is not decrypted. This enables policy enforcement for SaaS applications without breaking encryption. It is a Content-ID capability that extracts the certificate fields and maps them to an App-ID, satisfying the requirement to control the application while preserving privacy.

Why this answer

Certificate-based App-ID is designed to identify applications by examining the server certificate presented during the TLS handshake, without requiring decryption. This allows enforcement of security policies for SaaS applications while maintaining end-to-end encryption. Decryption profiles, File Blocking, and Data Filtering all require visibility into the payload, which is not available when traffic remains encrypted.

Thus, certificate-based App-ID is the correct Content-ID feature for this scenario.

Exam trap

The trap here is assuming that any Content-ID feature can inspect encrypted traffic without decryption, when only certificate-based App-ID can identify applications from the certificate metadata.

Practice this question →

12

MCQeasy

What is the primary benefit of using App-ID in a security policy instead of relying solely on port-based rules?

A.It increases firewall throughput.

B.It allows enforcement based on application identity, even if the application uses non-standard ports.

C.It reduces the number of security rules needed.

D.It limits traffic to HTTP and HTTPS only.

AnswerB

App-ID identifies applications by inspecting traffic characteristics rather than relying on TCP or UDP port numbers, so policies still match when an application runs on non-standard ports or attempts evasion. This satisfies enforcement based on application identity.

Why this answer

Palo Alto Networks App-ID identifies applications by inspecting multiple attributes — protocol signatures, SSL/TLS decryption, behavioral heuristics, and payload patterns — rather than relying on TCP/UDP port numbers. This means a policy can permit or deny traffic based on the actual application (e.g., Facebook, BitTorrent, Salesforce) regardless of whether it runs on port 80, 443, or a non-standard port. This defeats evasion techniques like port hopping and lets administrators write precise, application-aware rules.

Exam trap

PCNSA often tests whether candidates understand that App-ID's value is identity-based enforcement independent of ports, not performance or rule-count reduction — distractors exploit the assumption that 'more inspection equals more throughput' or 'better classification equals fewer rules.'

How to eliminate wrong answers

Option A is wrong because App-ID is a classification and inspection technology — it does not increase firewall throughput; in fact, deep inspection can reduce throughput relative to simple port-based forwarding. Option C is wrong because App-ID often requires more rules (or more granular rules) to express application-level policy, not fewer; rule-count reduction is not its primary benefit. Option D is wrong because App-ID recognizes thousands of applications across many protocols — it is not limited to HTTP/HTTPS, and restricting to those two would defeat its purpose.

Practice this question →

13

MCQmedium

A security administrator is creating a Security policy rule to allow only the business-critical functions of a SaaS application while blocking its social and file-sharing components. The administrator wants the firewall to distinguish between the different functions within the same application. Which App-ID capability should be used to accomplish this?

A.Application functions

B.Application subcategories

C.Application filters

D.Application containers

AnswerA

Application functions are child App-IDs that represent specific features within a parent application, such as file sharing, chat, or posting. By using the function App-ID in a Security policy rule, the administrator can allow or deny only that function while the parent application remains permitted. This provides the granular control required to permit business-critical functions and block social or file-sharing features.

Why this answer

Application functions are the mechanism App-ID uses to expose individual capabilities within a single application as separate policy objects. A rule that references a function App-ID can allow or deny that specific behavior without affecting the rest of the application. This is the only option that provides the required per-function granularity within the same SaaS application.

Exam trap

The trap here is confusing application filters, which group applications by shared attributes, with application functions, which identify individual features inside one application.

Practice this question →

14

MCQeasy

A security administrator needs to ensure that files downloaded by users are scanned for malware. The administrator has already configured a File Blocking profile to block malicious files. Which additional Palo Alto Networks security profile must be applied to the Security policy rule to inspect the file contents for known threats?

A.URL Filtering

B.Antivirus

C.Vulnerability Protection

D.Anti-Spyware

AnswerB

The Antivirus security profile is responsible for scanning files and data streams for viruses, spyware, and other malware. It uses signatures and heuristics to detect and block malicious content. Applying an Antivirus profile to the Security policy rule ensures that files are inspected and threats are stopped. The File Blocking profile only blocks files based on file type, not content, so the Antivirus profile is needed for malware detection.

Why this answer

To inspect file contents for malware, the Antivirus security profile must be applied to the Security policy rule. The Antivirus profile scans files and data streams for viruses, spyware, and other malicious code. While File Blocking profiles can block files by type, they do not analyze content.

Anti-Spyware, Vulnerability Protection, and URL Filtering serve different purposes and do not perform file content scanning for known threats.

Exam trap

The trap here is confusing File Blocking with Antivirus, thinking that a File Blocking profile alone can detect malware, when it only blocks based on file type and direction, not content.

Practice this question →

15

MCQeasy

A company wants to block file uploads of PDFs to the internet via HTTP. Which Content-ID profile should be configured?

A.Vulnerability Protection Profile

B.URL Filtering Profile

C.File Blocking Profile

D.Virus Profile

AnswerC

A File Blocking Profile inspects HTTP traffic and blocks transfers by file type, matching the PDF requirement directly. Unlike Data Filtering, which targets sensitive content patterns, or URL Filtering, which governs destinations, it enforces the stem's constraint: preventing outbound uploads of a specified file extension to the internet.

Why this answer

The File Blocking Profile is specifically designed to block file transfers based on file type, such as PDF, over protocols like HTTP. This profile uses Content-ID to inspect the file content and enforce blocking policies for uploads or downloads, making it the appropriate choice to prevent PDF uploads to the internet.

Exam trap

The trap here is that candidates often confuse File Blocking with URL Filtering or Antivirus, assuming that blocking a file type is handled by URL categories or malware scanning, when in fact it requires a dedicated Content-ID profile that inspects the file itself regardless of the URL or threat status.

How to eliminate wrong answers

Option A is wrong because Vulnerability Protection Profile is used to detect and block exploit attempts and malware delivery via vulnerabilities, not to block specific file types like PDFs. Option B is wrong because URL Filtering Profile controls access to websites based on URL categories and reputation, not file content or type. Option D is wrong because Virus Profile (antivirus) is designed to detect and block malware within files, but it does not block files based solely on their type (e.g., PDF) without a malicious signature.

Practice this question →

16

MCQeasy

A security administrator wants to block all peer-to-peer file sharing applications while allowing web browsing. Which type of security policy rule should they configure?

A.A URL filtering rule that blocks P2P websites.

B.A decryption rule that blocks encrypted P2P traffic.

C.An application-based rule that denies the 'peer-to-peer' application group.

D.A service-based rule that denies TCP ports 6881-6889.

AnswerC

Application-based rules use App-ID to identify applications regardless of port or protocol. The 'peer-to-peer' application group contains known P2P applications. Denying this group effectively blocks all peer-to-peer file sharing while allowing other applications like web browsing, as long as the rule is placed appropriately.

Why this answer

An application-based security policy rule using App-ID can identify and block the 'peer-to-peer' application group, which includes known P2P file sharing applications. This approach is effective regardless of the ports or protocols used. Service-based rules are port-dependent and easily bypassed.

URL filtering and decryption rules do not directly block P2P applications. Thus, the application-based rule is the correct choice.

Exam trap

The trap here is assuming that blocking specific ports or websites is sufficient to stop peer-to-peer file sharing, when P2P applications can use evasive techniques and require App-ID for accurate control.

Practice this question →

17

MCQmedium

A security administrator notices that a large number of unknown TCP sessions are being generated by an internal application. The administrator wants to identify the application using App-ID. Which action should they take first?

A.Enable logging on the security policy rule to capture the unknown sessions.

B.Submit a support ticket to Palo Alto Networks to create a new App-ID.

C.Use the Application Command Center (ACC) to view unknown applications and their characteristics.

D.Create a custom App-ID based on the destination port.

AnswerC

The Application Command Center (ACC) provides visibility into unknown applications, showing details such as source, destination, and port. This helps the administrator understand the traffic and decide whether to create a custom App-ID or request a new App-ID from Palo Alto Networks. It is the first step in identifying the application.

Why this answer

The Application Command Center (ACC) provides detailed visibility into unknown applications, including their traffic patterns and endpoints. By analyzing this information, the administrator can determine if the application is a custom internal tool or a known application that is not yet identified. This is the recommended first step before creating a custom App-ID or contacting support.

Other actions like creating a port-based App-ID or enabling logging are not as effective for initial identification.

Exam trap

The trap here is jumping to create a custom App-ID based on limited information, when the ACC should be used first to gather details about the unknown application.

Practice this question →

18

MCQhard

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

A.The security rules were modified.

B.The application database was rolled back.

C.The firewall needs a reboot.

D.The custom application signatures were not migrated.

AnswerD

App-ID upgrades replace the predefined signature database, so locally created custom application signatures are not carried across automatically. Unless those custom signatures are exported and re-imported, matching for the affected applications fails after the upgrade.

Why this answer

During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Exam trap

Palo Alto Networks often tests the misconception that App-ID upgrades only affect built-in applications, leading candidates to overlook the need to migrate custom application signatures, which are not automatically carried over.

How to eliminate wrong answers

Option A is wrong because modifying security rules changes policy enforcement, not the underlying application identification logic; App-ID identification is independent of rule configuration. Option B is wrong because a rollback of the application database would revert to a previous version, not cause a failure to identify applications after an upgrade; the question states an upgrade occurred, not a rollback. Option C is wrong because a reboot does not affect the integrity or migration of custom application signatures; rebooting only restarts services and does not restore missing custom objects.

Practice this question →

19

MCQmedium

A network administrator notices that traffic for a custom business application is being incorrectly identified as 'ssl' by the firewall. What is the most efficient way to ensure this application is accurately identified without impacting other SSL traffic?

A.Disable App-ID for the security policy rule that allows this traffic.

B.Upgrade the App-ID database to the latest version.

C.Create an App-ID override for the application's specific IP addresses and ports.

D.Add the application's TCP port to the service definition in the security policy.

AnswerC

An App-ID override forces the firewall to classify traffic matching the specified IP addresses and ports as the custom application, bypassing SSL decryption-based identification. Scoping by IP and port leaves all other SSL traffic classified normally.

Why this answer

An App-ID override allows you to manually assign a specific application signature to traffic matching defined IP addresses and ports, ensuring the custom business application is correctly identified without altering the global App-ID database or affecting other SSL traffic. This is the most efficient method as it directly overrides the incorrect identification at the application level, preserving the integrity of other SSL-based application detection.

Exam trap

The trap here is that candidates often confuse App-ID override with service definitions or disabling App-ID, thinking that changing port-based classification or updating signatures will fix custom application identification, when in fact only a direct application override provides precise control without collateral impact.

How to eliminate wrong answers

Option A is wrong because disabling App-ID for the security policy rule would cause the firewall to rely solely on IP addresses and ports for classification, potentially allowing malicious traffic to bypass application-level inspection and degrading security. Option B is wrong because upgrading the App-ID database updates signatures for known applications but cannot resolve misidentification of a custom application that lacks a predefined signature. Option D is wrong because adding the application's TCP port to the service definition only matches traffic based on port numbers, not application identity, and does not correct the App-ID misclassification; it may also inadvertently allow non-application traffic on that port.

Practice this question →

20

Multi-Selectmedium

Which TWO statements are true regarding App-ID and Content-ID? (Choose two.)

Select 2 answers

A.Content-ID provides capabilities such as File Blocking, Data Filtering, and URL Filtering.

B.App-ID can identify applications regardless of the port or protocol used.

C.Content-ID only works for web traffic.

D.App-ID requires SSL decryption to identify encrypted applications.

E.Content-ID can function without App-ID enabled.

AnswersA, B

Content-ID inspects payload and URL content, enforcing File Blocking, Data Filtering and URL Filtering policies. This satisfies the stem by covering threat and data controls that operate on content within permitted applications, complementing App-ID's application-level classification.

Why this answer

Option A is correct because Content-ID is the Palo Alto Networks security subscription service that delivers threat prevention and content inspection capabilities, including File Blocking, Data Filtering, and URL Filtering, which examine the payload and content of allowed traffic. Option B is correct because App-ID classifies traffic by identifying the application based on its unique characteristics and behavior, not merely on TCP/UDP port or protocol, so it can recognize applications even when they run on non-standard ports or tunnel over other protocols. Option C is incorrect because Content-ID inspects many traffic types beyond web (HTTP/HTTPS), such as SMTP, FTP, SMB, and other application streams, not only web traffic.

Option D is incorrect because App-ID can identify many encrypted applications through heuristics, TLS metadata, and certificate information without full SSL decryption, though decryption is needed for deeper inspection. Option E is incorrect because Content-ID depends on App-ID to first identify and classify the application so the appropriate content and threat profiles can be applied; without App-ID, Content-ID scanning is not properly contextualized or enforced.

Exam trap

PCNSA often tests the misconception that Content-ID can operate independently of App-ID, or that App-ID requires SSL decryption to identify encrypted applications.

Practice this question →

21

MCQmedium

A security administrator wants to allow access to a SaaS application but block specific high-risk functions within that application, such as file uploads. The application uses HTTP and HTTPS. Which Palo Alto Networks feature should the administrator use to granularly control application functions?

A.App-ID with application functions

B.App-ID with application filters

C.Content-ID with Data Filtering

D.App-ID with application override

AnswerA

App-ID includes the ability to identify and control specific functions within an application, known as application functions or sub-functions. For example, some SaaS applications have functions like 'file-sharing' or 'upload'. By using these in security policy, the administrator can allow the application but block specific high-risk functions, providing granular control.

Why this answer

App-ID can identify not only the application but also specific functions within it, such as file upload or posting. By using these application functions in security policy rules, the administrator can allow the SaaS application while blocking high-risk actions like file uploads. This provides granular control without blocking the entire application.

Exam trap

The trap here is thinking that application filters or Data Filtering can control specific functions within an application, but only App-ID's function-level identification provides that capability.

Practice this question →

22

MCQmedium

A user reports that they are unable to download executable files from the internet. The firewall security rule allows the application. What should the administrator check first?

A.The SSL decryption policy.

B.The vulnerability protection profile.

C.The file blocking profile for the rule.

D.The URL filtering category for 'executables'.

AnswerC

File blocking profiles inspect file types within allowed applications, so executables can be blocked even when the application itself is permitted. Checking this profile first identifies whether a file-type restriction, rather than the security rule, is preventing the download.

Why this answer

The user cannot download executable files, which is a specific file type. The file blocking profile is the Content-ID feature that controls file transfer based on type, regardless of the application being allowed. Since the security rule permits the application, the administrator should first check the file blocking profile attached to that rule to see if it blocks 'executable' files.

Exam trap

The trap here is that candidates confuse file blocking with URL filtering or application control, assuming that allowing the application automatically permits all file transfers, but Content-ID file blocking operates independently at the file level.

How to eliminate wrong answers

Option A is wrong because SSL decryption policy controls whether encrypted traffic is decrypted for inspection, not the blocking of specific file types like executables. Option B is wrong because vulnerability protection profiles detect and prevent exploit attempts, not file type transfers. Option D is wrong because URL filtering categories classify web pages by content (e.g., 'malware', 'hacking'), not by file extension or MIME type; there is no URL filtering category named 'executables'.

Practice this question →

23

Multi-Selectmedium

Which TWO statements about App-ID are correct? (Choose two.)

Select 2 answers

A.App-ID can identify applications even if they use standard ports for other services.

B.App-ID is only effective for well-known commercial applications.

C.App-ID primarily identifies applications based on port numbers.

D.App-ID uses signatures to identify known applications.

E.App-ID requires at least 10 packets to identify an application.

AnswersA, D

App-ID decodes protocol behaviour rather than trusting port numbers, so it recognises applications tunnelled over non-standard or misleading ports, such as HTTP on port 8080 or SSH on 443. This satisfies the requirement to identify applications regardless of port.

Why this answer

Option A is correct because App-ID performs application identification through deep packet inspection and protocol decoding rather than relying on TCP/UDP port numbers, so it can detect an application even when it runs on a port normally associated with a different service (for example, SSH tunneled over port 80 or peer-to-peer traffic on port 443). Option D is correct because App-ID relies on a signature- and context-based engine that matches known application traffic patterns, protocol behaviors, and heuristics to classify applications accurately. Options B, C, and E are incorrect: App-ID is not limited to well-known commercial applications (it also identifies custom, evasive, and unknown applications), it does not primarily identify applications by port numbers (that is the legacy port-based approach App-ID replaces), and it does not require a fixed minimum of 10 packets, since identification can occur after the first few packets or even the first packet depending on the protocol.

Exam trap

Palo Alto Networks often tests the misconception that App-ID relies on port numbers, tempting candidates to select option C, but the correct understanding is that App-ID is port-agnostic and uses multiple deeper inspection methods.

Practice this question →

24

MCQhard

An organization uses a custom ERP system that communicates over TCP port 4444. The firewall's App-ID incorrectly identifies some of the traffic as 'ssl' because the ERP system uses a proprietary encryption wrapper. What is the recommended approach to ensure correct identification?

A.Use Application Override to force the ERP application for all traffic on port 4444.

B.Enable SSL decryption to inspect the encrypted traffic.

C.Create a custom App-ID that matches the proprietary encryption wrapper signature.

D.Add a security rule that allows the ERP application object without further configuration.

AnswerC

A custom App-ID matching the proprietary encryption wrapper's signature lets the firewall identify the ERP traffic by its actual application rather than misclassifying it as ssl. This satisfies the stem's requirement for correct identification of TCP port 4444 traffic, since App-ID inspects payload signatures independently of port.

Why this answer

When App-ID misclassifies traffic due to a proprietary encryption wrapper, the recommended approach is to create a custom App-ID that matches the specific signature of that wrapper. This allows the firewall to correctly identify the application without relying on port-based heuristics or decryption, preserving the integrity of the encrypted session while ensuring accurate policy enforcement.

Exam trap

The trap here is that candidates often confuse Application Override (which disables App-ID) with a custom App-ID (which enhances App-ID), leading them to choose Option A as a quick fix instead of the more precise and correct solution of creating a custom signature.

How to eliminate wrong answers

Option A is wrong because Application Override bypasses App-ID entirely, forcing all traffic on port 4444 to be treated as the specified application, which can mask other legitimate or malicious traffic on that port and is not a precise solution for misclassification. Option B is wrong because enabling SSL decryption would require the firewall to decrypt the proprietary encryption wrapper, which may not be possible if the wrapper is not standard SSL/TLS, and it introduces unnecessary overhead and privacy concerns. Option D is wrong because simply allowing the ERP application object without further configuration does not address the root cause of misidentification; the firewall will still incorrectly classify the traffic as 'ssl' and the rule may not match as intended.

Practice this question →

25

MCQhard

A security administrator is configuring a Data Filtering profile to prevent sensitive customer data from leaving the network via webmail. The administrator wants to block any email that contains a U.S. Social Security Number. Which Data Filtering profile setting should be used to detect the SSN pattern?

A.Application override for webmail

B.File type matching for .txt files

C.Predefined pattern for Social Security Number

D.Custom pattern using a regular expression

AnswerC

The Data Filtering profile includes predefined patterns for common sensitive data types, such as U.S. Social Security Numbers. Selecting this pattern enables the firewall to detect and block traffic containing SSNs. This is the correct approach because it uses built-in regex patterns designed to match the SSN format, ensuring accurate detection without custom configuration.

Why this answer

The Data Filtering profile provides predefined patterns for common sensitive data types, including U.S. Social Security Numbers. By selecting the predefined SSN pattern, the administrator can reliably detect and block emails containing SSNs.

This leverages built-in regular expressions optimized for accurate detection, avoiding the need for custom patterns that may be error-prone.

Exam trap

The trap here is assuming that a custom regex is needed for SSN detection, but Palo Alto Networks provides predefined patterns for common data types, simplifying configuration and improving accuracy.

Practice this question →

26

MCQhard

An administrator is troubleshooting why an application is being identified as 'incomplete' in the traffic log. What does this indicate?

A.The application is using a non-standard port.

B.The session was terminated before App-ID could complete.

C.The firewall could not determine the application.

D.The application is unknown to the firewall.

AnswerB

An 'incomplete' App-ID verdict means the firewall saw too few packets to match a signature, because the session ended early. This satisfies the stem's troubleshooting scenario: the application could not be identified since App-ID never finished its multi-stage inspection before the session closed.

Why this answer

When App-ID cannot complete its analysis before the session terminates, the traffic log marks the application as 'incomplete'. This typically happens with short-lived sessions or when the firewall receives insufficient data packets to match a signature or decode the protocol. The correct answer is B because App-ID requires multiple packets or a full handshake to definitively identify the application.

Exam trap

The trap here is confusing 'incomplete' with 'unknown' or 'not-applicable', where candidates incorrectly think the firewall simply cannot identify the application, rather than understanding that the session ended before App-ID finished processing.

How to eliminate wrong answers

Option A is wrong because using a non-standard port does not cause an 'incomplete' status; App-ID can still identify applications on non-standard ports via protocol decoders and behavioral signatures. Option C is wrong because 'incomplete' specifically means App-ID was still processing when the session ended, not that it failed to determine the application (which would be 'unknown' or 'not-applicable'). Option D is wrong because 'unknown' is a separate status indicating the application is not in the App-ID database, whereas 'incomplete' means the identification process was interrupted.

Practice this question →

27

Multi-Selecteasy

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Select 2 answers

A.URL filtering

B.Source port number

C.Source IP address

D.Pattern matching (signatures)

E.Protocol decoding

AnswersD, E

App-ID applies signature-based pattern matching to payload content, inspecting known byte sequences and protocol markers within the traffic stream. This complements protocol and behavioural decoders, letting the firewall recognise the application itself rather than relying solely on port or header information.

Why this answer

App-ID identifies applications primarily through pattern matching (signatures) (D), which inspects packet payloads against a database of application-specific signatures to recognize known applications, and protocol decoding (E), which decodes the application-layer protocol to understand its behavior and enforce policy even when traffic is encrypted or evasive. These two techniques are the core detection mechanisms Palo Alto Networks documents for App-ID, working alongside behavioral heuristics and decryption. URL filtering (A) is a separate security profile that controls web access by category, not an App-ID identification method.

Source port number (B) and source IP address (C) are Layer 3/4 header attributes used in traditional firewall rules, not application identification techniques.

Exam trap

The trap here is that candidates often confuse App-ID with port-based or IP-based identification, mistakenly thinking that source port or IP address are used to identify applications, when in fact App-ID relies on protocol decoding and signature matching to determine the actual application regardless of port or address.

Practice this question →

28

MCQeasy

Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?

A.URL Filtering

B.File Blocking

C.Data Filtering

D.WildFire

AnswerC

Data Filtering inspects traffic for defined patterns, such as credit card or national insurance numbers, and blocks or alerts on matches, directly preventing data loss. Other Content-ID features classify applications or threats rather than matching sensitive data patterns.

Why this answer

Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.

Exam trap

The trap here is that candidates often confuse Data Filtering with File Blocking, assuming that blocking file transfers is the primary DLP mechanism, when in fact Data Filtering is the dedicated feature for pattern-based content inspection within allowed traffic.

How to eliminate wrong answers

Option A is wrong because URL Filtering controls access to websites based on categories and URLs, not by inspecting the content of traffic for specific patterns to prevent data loss. Option B is wrong because File Blocking blocks file transfers based on file type (e.g., .exe, .pdf) or direction, but it does not scan the content of files or data streams for sensitive patterns. Option D is wrong because WildFire is a threat analysis service for unknown malware and exploits, not a feature for blocking specific data patterns to prevent data loss.

Practice this question →

29

MCQeasy

Which of the following is a primary benefit of using App-ID in a security policy?

A.It enforces policies based on the actual application, irrespective of port or encryption.

B.It allows blocking traffic based on port numbers only.

C.It only works for known applications.

D.It can only be applied to outbound traffic.

AnswerA

App-ID classifies traffic by application characteristics rather than port or protocol, so policies remain effective when apps use non-standard ports, hop ports, or SSL/TLS encryption. This application-level identification is the primary benefit over port-based rules.

Why this answer

App-ID is a core Palo Alto Networks technology that identifies traffic based on application signatures, not just port or protocol. This allows security policies to enforce rules based on the actual application (e.g., Facebook, Salesforce) even if it uses non-standard ports or is encrypted via SSL/TLS. The primary benefit is decoupling application identification from port, enabling granular control over application usage regardless of how the application is disguised.

Exam trap

The trap here is that candidates often assume App-ID is just another port-based firewall feature, but the exam tests the understanding that App-ID identifies applications regardless of port or encryption, making it a fundamental shift from traditional port-based security policies.

How to eliminate wrong answers

Option B is wrong because App-ID does not rely on port numbers; it identifies applications by their unique signatures, behavior, and decryption, making port-based blocking a legacy and ineffective approach. Option C is wrong because App-ID can identify unknown or custom applications using behavioral analysis and heuristics, not just known applications from the application database. Option D is wrong because App-ID can be applied to both inbound and outbound traffic, as security policies are bidirectional and App-ID inspects all traffic flows.

Practice this question →

30

MCQmedium

A company has a security policy that allows 'ssl' application but does not have SSL decryption enabled. What can App-ID still identify from the encrypted session?

A.The SNI (Server Name Indication).

B.The exact URL being accessed.

C.The file type being transferred.

D.The client and server IP addresses.

AnswerA

Without decryption, App-ID reads the TLS ClientHello, which is sent in cleartext, and extracts the SNI field to identify the destination hostname. This satisfies the stem's constraint of allowing the ssl application while decryption remains disabled, letting App-ID distinguish encrypted sessions by server name.

Why this answer

App-ID can identify the SNI (Server Name Indication) from an encrypted session because the SNI is sent in cleartext during the TLS handshake, before encryption begins. This allows the firewall to determine the destination hostname without decrypting the traffic, enabling policy enforcement based on the application or domain even when SSL decryption is disabled.

Exam trap

The trap here is that candidates assume all encrypted traffic is opaque to App-ID, but the SNI field remains visible and can be used for application identification, which is a key distinction tested in the PCNSA exam.

How to eliminate wrong answers

Option B is wrong because the exact URL (including path and query parameters) is encrypted within the TLS tunnel and cannot be inspected without SSL decryption. Option C is wrong because the file type being transferred is determined by inspecting the payload after decryption or via protocol decoding, which is not possible in an encrypted session. Option D is wrong because while client and server IP addresses are visible in the packet headers, they are not identified by App-ID; App-ID focuses on application-level identification, not network-layer addressing.

Practice this question →

31

MCQeasy

A security administrator wants to block all peer-to-peer file sharing applications, such as BitTorrent, regardless of the port they use. Which Palo Alto Networks feature should the administrator use to accomplish this?

A.User-ID

B.Content-ID

C.Service objects

D.App-ID

AnswerD

App-ID identifies applications based on their unique characteristics, regardless of port or protocol. By creating a security policy rule that denies the application 'bittorrent', the administrator can block it even if it uses non-standard ports or encryption. This is the correct approach because App-ID provides application-level control independent of port.

Why this answer

App-ID is the feature that identifies applications regardless of port, protocol, or encryption. By using App-ID in a security policy rule, the administrator can deny the BitTorrent application directly, ensuring it is blocked even if it tries to use different ports. This provides accurate application control without relying on port-based rules.

Exam trap

The trap here is thinking that blocking a specific port or using a service object will stop peer-to-peer applications, but these applications can easily switch ports to evade such controls.

Practice this question →

32

MCQmedium

An administrator wants to block all peer-to-peer file sharing traffic, but must ensure that legitimate business applications like FTP are not affected. Which approach is most effective?

A.Create an Application Filter that matches all P2P applications and use it in a deny rule.

B.Create a security rule with 'application none' and block the common P2P ports.

C.Use a Service object to block all ports typically used by P2P applications.

D.Identify each known P2P application and add them individually to a block rule.

AnswerA

An Application Filter groups all peer-to-peer applications by App-ID, and referencing it in a deny rule blocks that traffic while FTP, identified as a distinct application, remains permitted. This satisfies both the blocking and the legitimate-traffic constraints.

Why this answer

Palo Alto Networks App-ID can identify peer-to-peer (P2P) traffic by application signature, regardless of port. Creating an Application Filter that matches all P2P applications (e.g., BitTorrent, eDonkey, Gnutella) and applying it in a deny rule ensures all P2P traffic is blocked while legitimate business applications like FTP (which uses distinct App-ID signatures) are not affected, as App-ID decodes traffic at Layer 7.

Exam trap

The trap here is that candidates often assume port-based blocking (Options B and C) is sufficient, but App-ID is designed to decouple application identity from port, making port-based rules ineffective against modern P2P traffic that uses port evasion techniques.

How to eliminate wrong answers

Option B is wrong because using 'application none' with port blocking is ineffective—P2P applications often use non-standard ports or port hopping, and 'application none' would not match traffic that App-ID identifies as a known application, potentially allowing P2P traffic on allowed ports. Option C is wrong because blocking common P2P ports (e.g., 6881-6889 for BitTorrent) is easily bypassed by P2P applications that use random or HTTP/HTTPS ports, and it would also block legitimate applications using those ports. Option D is wrong because individually adding each known P2P application to a block rule is impractical—new P2P variants emerge frequently, and this approach would miss unknown or custom P2P applications, leaving gaps in coverage.

Practice this question →

33

MCQeasy

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. What is the most likely cause?

A.The application signature database is outdated.

B.App-ID is disabled on the security rule.

C.The custom application uses HTTP but no specific App-ID signature.

D.Content-ID is blocking the application.

AnswerC

Traffic using HTTP without a dedicated App-ID signature falls back to the web-browsing signature, since Palo Alto firewalls identify applications by signature rather than port alone. The custom application therefore matches the generic HTTP decoder, satisfying the stem's constraint of misidentification caused by a missing application signature.

Why this answer

When a custom application uses HTTP but lacks a specific App-ID signature, Palo Alto Networks firewalls default to classifying the traffic as web-browsing (HTTP). App-ID relies on a combination of protocol decoders and application signatures; without a custom App-ID signature defined for the application, the firewall cannot distinguish it from generic HTTP traffic.

Exam trap

Palo Alto Networks often tests the misconception that an outdated signature database is the root cause, but the trap here is that the custom application has no signature at all, so updating the database would not help—the administrator must create a custom App-ID signature or use an application override.

How to eliminate wrong answers

Option A is wrong because an outdated signature database would affect the identification of known applications, but the issue here is that the custom application has no specific signature at all, not that the signature is stale. Option B is wrong because if App-ID were disabled on the security rule, the firewall would not perform any application identification, and traffic would be classified based on port or IP, not incorrectly identified as web-browsing. Option D is wrong because Content-ID is a separate feature that handles URL filtering, file blocking, and data filtering; it does not affect how traffic is initially identified by App-ID.

Practice this question →

34

Multi-Selecteasy

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Select 2 answers

A.Create a security rule with the application and action 'deny'.

B.Block the common ports used by the application.

C.Disable App-ID on the zone to prevent inspection.

D.Create a security rule allowing the application but with a limit.

E.Use an Application Override to categorize the traffic and then block it.

AnswersA, E

App-ID identifies the application regardless of port, so a security rule referencing that application with a deny action blocks all its traffic across every port it uses. This satisfies the requirement without enumerating individual ports.

Why this answer

Option A is correct because a security rule that references the application by name (via App-ID) and sets the action to 'deny' blocks all traffic identified as that application regardless of which ports it uses, which is exactly what is needed for a multi-port application. Option E is correct because an Application Override policy lets the firewall reclassify traffic on specified ports as a known application, after which a security rule can deny that application, providing a way to block traffic that App-ID might not otherwise identify across its multiple ports. Option B is not ideal because blocking only the common ports leaves the application free to use other ports, so it does not reliably block all traffic from the application.

Option C is wrong because disabling App-ID removes the ability to identify and control the application by name. Option D is wrong because allowing the application with a limit still permits traffic rather than blocking it.

Exam trap

The trap here is that candidates mistakenly think blocking common ports (Option B) is sufficient, but the exam tests the understanding that App-ID is application-aware and port-independent, making application-based blocking the correct approach.

Practice this question →

35

MCQhard

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

A.The security rule is misconfigured because it lacks an application field.

B.App-ID has not yet completed identification because the session is new or requires more packets.

C.The firewall does not have an App-ID signature for the website.

D.SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

AnswerB

App-ID inspects multiple packets before assigning an application; a brand-new session or one with insufficient payload yields 'incomplete', so the Block-Unknown-App rule matches. This explains the failure without implying a misconfigured rule or blocked port.

Why this answer

When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Exam trap

Palo Alto Networks often tests the distinction between 'incomplete' (App-ID still processing) and 'unknown' (App-ID could not identify the application), so the trap here is assuming 'incomplete' means the firewall lacks a signature or that SSL decryption is mandatory for HTTPS identification.

How to eliminate wrong answers

Option A is wrong because the rule does have an application field (it matches 'unknown-app'), so the misconfiguration is not about a missing application field. Option C is wrong because 'incomplete' does not mean the firewall lacks a signature; it means the identification process is still ongoing, not that the signature is absent. Option D is wrong because SSL decryption is not required for App-ID to identify HTTPS traffic; App-ID can identify many HTTPS applications using metadata such as SNI, JA3 fingerprints, or IP addresses without decrypting the traffic.

Practice this question →

36

Multi-Selecthard

A security administrator is troubleshooting why a custom application is not being identified by App-ID. The application uses a proprietary protocol over TCP and is not recognized. Which two actions can the administrator take to enable App-ID to identify this application? (Choose two.)

Select 2 answers

A.Create a custom App-ID signature using the Application Objects interface.

B.Enable SSL decryption for the application's traffic.

C.Configure a URL Filtering profile to categorize the application's traffic.

D.Use Application Override to force the traffic to a custom application based on port and IP.

E.Create a Security policy rule to allow the application's IP address and port.

AnswersA, D

Creating a custom App-ID signature allows the administrator to define patterns and characteristics for the proprietary application. This is done through the Application Objects interface in PAN-OS, where you can specify protocol, port, and patterns. Once created, the custom App-ID can be used in Security policy rules. This is a valid method to enable identification of applications not recognized by the built-in App-ID database.

Why this answer

To enable App-ID to identify a proprietary application, the administrator can create a custom App-ID signature, which defines patterns for the application, or use Application Override to force traffic to a custom application based on IP and port. Both methods allow the firewall to recognize and control the application. SSL decryption, URL Filtering, and IP/port-based Security rules do not provide application identification for non-web, non-TLS proprietary protocols.

Exam trap

The trap here is thinking that SSL decryption or URL Filtering can help identify any application, when they are specific to encrypted or web traffic.

Practice this question →

37

MCQhard

During a security audit, it is discovered that FTP traffic over non-standard ports is bypassing App-ID inspection. What is the most effective method to ensure all FTP traffic is identified, regardless of port?

A.Update the App-ID and threat databases to the latest version.

B.Set the security policy to 'allow' without App-ID to ensure FTP works.

C.Add the non-standard port to the FTP service definition.

D.Create an Application Override rule for FTP on the required source and destination addresses.

AnswerD

Application Override forces App-ID to treat the traffic as FTP.

Why this answer

The most effective method is to create an Application Override rule for FTP, which forces App-ID to identify traffic as FTP based on source/destination addresses, regardless of port. Option A is wrong because updating databases does not change detection on non-standard ports; App-ID relies on port-based signatures unless overridden. Option B is wrong because disabling App-ID removes all application inspection.

Option C is wrong because adding a non-standard port to the FTP service definition does not automatically enable App-ID identification; service definitions are used for policy enforcement, not for application identification. Option D is correct because an Application Override rule explicitly tells the firewall to treat traffic that matches the source and destination addresses as the specified application, bypassing port-based detection.

Practice this question →

38

MCQhard

A security administrator needs to ensure that employees cannot post credit card numbers on social media websites. The company uses Palo Alto Networks firewalls with SSL decryption configured for outbound traffic. Which Content-ID feature should be used to detect and block the credit card numbers in HTTP POST requests to social media sites?

A.File Blocking profile that blocks the 'any' file type in the upload direction.

B.Vulnerability Protection profile that blocks HTTP POST requests containing numeric patterns.

C.Antivirus security profile with a custom signature for credit card numbers.

D.Data Filtering profile with a custom pattern for credit card numbers.

AnswerD

Data Filtering profiles can include custom patterns to detect specific data formats, such as credit card numbers. When applied to a security rule that allows social media applications, the firewall inspects HTTP POST requests (after decryption) for these patterns and can block the session. This directly prevents posting credit card numbers.

Why this answer

Data Filtering profiles are specifically designed to detect and control sensitive data such as credit card numbers. By applying a Data Filtering profile with a custom pattern to the security rule that allows social media applications, the firewall can inspect decrypted HTTP POST requests and block those containing credit card numbers. This is the correct Content-ID feature for this scenario.

Exam trap

The trap here is confusing data loss prevention with file blocking or threat prevention, assuming that blocking file uploads or scanning for malware will also detect credit card numbers in web forms.

Practice this question →

39

MCQmedium

A security administrator needs to ensure that users cannot upload files containing malware to cloud storage applications. The administrator has enabled SSL decryption and wants to use WildFire to inspect files. Which configuration is required to submit files to WildFire for analysis?

A.Configure a Data Filtering profile to inspect file contents for malware patterns.

B.Configure a WildFire Analysis profile and apply it to the Security policy rule that allows the cloud storage applications.

C.Configure an Antivirus profile to scan file uploads and block malware.

D.Configure a File Blocking profile to block all file uploads to cloud storage applications.

AnswerB

A WildFire Analysis profile specifies which file types and directions to submit to WildFire for analysis. Applying it to the Security policy rule that permits the cloud storage applications ensures that files uploaded to those applications are inspected. With SSL decryption enabled, the firewall can extract files from the encrypted traffic and send them to WildFire. This configuration directly meets the requirement.

Why this answer

To submit files to WildFire for analysis, a WildFire Analysis profile must be configured and applied to the relevant Security policy rule. This profile defines which file types and directions are sent to WildFire. With SSL decryption enabled, the firewall can inspect encrypted uploads to cloud storage and forward files to WildFire.

Other profiles like File Blocking, Antivirus, or Data Filtering do not provide WildFire submission.

Exam trap

The trap here is assuming that an Antivirus profile or File Blocking profile automatically submits files to WildFire, when a separate WildFire Analysis profile is required.

Practice this question →

40

MCQhard

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

A.Ensure the application uses a standard port.

B.Ensure SSL decryption is enabled for the application.

C.Check if the application override is applied to the correct rule.

D.Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.

AnswerD

App-ID requires the session to be permitted by a security policy rule with application identification enabled; otherwise traffic is dropped before inspection. Verifying the packet reaches the firewall and matches such a rule is the prerequisite for any App-ID override to take effect.

Why this answer

App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

Exam trap

The trap here is that candidates assume an application override is a standalone fix that works regardless of the security policy rule's App-ID setting, when in fact the override is only evaluated if the rule has App-ID enabled and the traffic matches that rule.

How to eliminate wrong answers

Option A is wrong because App-ID is designed to identify applications regardless of port, and application overrides do not require a standard port; in fact, many custom applications use non-standard ports. Option B is wrong because SSL decryption is only needed if the application traffic is encrypted and you want to inspect the payload, but the application override itself does not require decryption to be enabled. Option C is wrong because the application override is a configuration object that maps a custom application to a specific signature or port, and while it must be applied to a rule, the first verification step is to confirm the traffic is actually hitting a security policy rule with App-ID enabled, not just that the override is attached to any rule.

Practice this question →

41

MCQhard

An administrator configures a custom App-ID signature using a packet buffer override. What is the implication?

A.The custom signature will only match on specific ports.

B.The custom signature will be ignored if it conflicts with built-in.

C.The custom signature requires a separate license.

D.The firewall will use the custom signature instead of the default.

AnswerD

A packet buffer override lets the custom signature inspect more context than the default App-ID can, so the firewall matches traffic against it in preference to the built-in signature for that application, satisfying the requirement to detect the modified traffic pattern.

Why this answer

When a custom App-ID signature is configured with a packet buffer override, the firewall is instructed to use the custom signature's definition to identify the application instead of relying on the default built-in App-ID signature. This override ensures that the custom signature takes precedence over any existing default signature for the same application, allowing the administrator to enforce a specific application identification behavior.

Exam trap

The trap here is that candidates mistakenly think a packet buffer override only affects port-based matching or that custom signatures are always subordinate to built-in signatures, when in fact the override explicitly gives the custom signature priority.

How to eliminate wrong answers

Option A is wrong because a packet buffer override does not restrict matching to specific ports; App-ID signatures can match on content regardless of port, and the override only affects which signature is used. Option B is wrong because the packet buffer override is specifically designed to resolve conflicts by making the custom signature take precedence over the built-in one, not to be ignored. Option C is wrong because custom App-ID signatures do not require a separate license; they are a standard feature of the App-ID engine available in the base firewall subscription.

Practice this question →

42

MCQmedium

A security administrator wants to prevent users from posting sensitive data, such as social security numbers, to web forms on external websites. The administrator has enabled SSL decryption for outbound traffic. Which Content-ID feature should be configured to detect and block this activity?

A.Antivirus profile

B.File Blocking profile

C.Data Filtering profile

D.URL Filtering profile

AnswerC

Data Filtering profiles are designed to detect and control sensitive data patterns, such as social security numbers and credit card numbers, in web forms and other traffic. With SSL decryption enabled, the firewall can inspect the content and apply the Data Filtering profile to block or alert on the transmission. This directly addresses the requirement to prevent posting sensitive data.

Why this answer

Data Filtering profiles are specifically designed to detect and control sensitive data patterns, including social security numbers, in web traffic. When SSL decryption is enabled, the firewall can inspect the content of web forms and apply the Data Filtering profile to block or alert on the transmission. This is the correct feature to prevent data leakage through web forms.

Exam trap

The trap here is assuming that URL Filtering or File Blocking can inspect data content, when only Data Filtering is designed for pattern-based sensitive data detection.

Practice this question →

43

Multi-Selectmedium

Which TWO of the following are true about App-ID? (Choose two.)

Select 2 answers

A.App-ID cannot identify custom applications.

B.App-ID identifies applications regardless of port.

C.App-ID uses signatures, protocol decoding, and behavioral analysis to identify applications.

D.App-ID can only identify applications on standard ports.

AnswersB, C

App-ID decouples identification from TCP/UDP port numbers, so applications are recognised by their actual traffic characteristics rather than the port they happen to use. This satisfies the requirement that identification holds true even when applications run on non-standard or evasive ports.

Why this answer

Option B is correct because App-ID performs application identification independent of the TCP/UDP port in use, so an application running on a non-standard port is still recognized rather than being assumed from its port number. Option C is correct because App-ID combines multiple identification techniques — application signatures, protocol decoding, and behavioral/heuristic analysis — to accurately classify traffic, including evasive applications. Option A is incorrect because App-ID supports custom application signatures, allowing administrators to define and identify proprietary or internal applications.

Option D is incorrect because App-ID is explicitly not limited to standard ports; port-independent identification is a core design goal of App-ID.

Exam trap

The trap here is that candidates often assume App-ID relies on port numbers for identification, similar to traditional firewalls, but the exam tests the understanding that App-ID is port-agnostic and uses deep packet inspection to identify applications regardless of the port used.

Practice this question →

44

MCQmedium

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

A.The firewall needs to have Application Override enabled for the custom signature to work.

B.The firewall must be restarted to apply the new custom signature.

C.The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.

D.The signature must be imported from the Palo Alto Networks application database.

AnswerC

App-ID identification occurs only at session setup, so existing sessions retain their original verdict of web-browsing or ssl. Because the custom signature was committed after those flows began, the firewall never re-evaluates them. Terminating the current sessions forces new ones, where the payload pattern is matched and the custom App-ID applied.

Why this answer

App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire.

Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Exam trap

The trap here is that candidates assume a commit immediately updates all traffic, but Palo Alto Networks firewalls only apply App-ID changes to new sessions, not existing ones.

How to eliminate wrong answers

Option A is wrong because Application Override is used to force a specific application for all traffic on a given port, bypassing App-ID entirely; it is not required for a custom App-ID signature to work. Option B is wrong because Palo Alto Networks firewalls do not require a restart to apply new custom App-ID signatures; a commit is sufficient to activate them. Option D is wrong because custom App-ID signatures are created locally by the administrator and do not need to be imported from the Palo Alto Networks application database; that database is for predefined applications.

Practice this question →

45

Multi-Selecthard

A security administrator is configuring a Data Filtering profile to prevent sensitive information from leaving the corporate network via web traffic. The administrator wants to detect and block patterns such as credit card numbers and social security numbers in HTTP POST requests. Which two actions can the Data Filtering profile take when a match is found? (Choose two.)

Select 2 answers

A.Continue

B.Reset Client

C.Alert

D.Block

E.Allow

AnswersC, D

The Alert action in a Data Filtering profile generates a log entry and an alert but does not block the traffic. It is useful for monitoring and auditing sensitive data patterns without disrupting business operations. In this scenario, the administrator can use Alert to identify potential data leaks and then decide whether to escalate to blocking. It allows visibility into what data is being transmitted.

Why this answer

Data Filtering profiles support two primary actions when a pattern match occurs: Alert and Block. Alert generates a log and notification without stopping the traffic, while Block prevents the data from being transmitted. These actions allow administrators to monitor or enforce policies on sensitive data.

Other actions like Allow, Reset Client, and Continue are not available in Data Filtering profiles, making Alert and Block the correct choices for this scenario.

Exam trap

The trap here is assuming that Data Filtering profiles have the same actions as other security profiles, such as 'Reset Client' or 'Allow', when in fact they only support Alert and Block.

Practice this question →

46

Multi-Selecteasy

Which THREE Content-ID components typically require a separate license or subscription?

Select 3 answers

A.SSL Decryption

B.File Blocking

C.WildFire

D.URL Filtering (PAN-DB)

E.Data Filtering

AnswersA, C, D

SSL Decryption requires a separate license.

Why this answer

SSL Decryption (A) is correct because decrypting TLS/SSL traffic on Palo Alto Networks firewalls requires a dedicated SSL Forward Proxy/Inbound Inspection license to enable the decryption policy and certificate management features. WildFire (C) is correct because WildFire cloud sandboxing and its associated threat intelligence subscriptions are sold as a separate license from the base Content-ID bundle. URL Filtering with PAN-DB (D) is correct because the PAN-DB URL filtering database subscription is licensed separately and is not included in the base Content-ID package.

File Blocking (B) is not correct because it is a standard Content-ID feature included with the base subscription, and Data Filtering (E) is not correct because it is included with the URL Filtering (PAN-DB) subscription rather than requiring its own separate subscription.

Exam trap

The trap here is that candidates often assume Data Filtering requires its own license, but it is actually included with the URL Filtering (PAN-DB) subscription. Similarly, File Blocking is included with the Threat Prevention subscription. The three components that truly require separate licenses are SSL Decryption, WildFire, and URL Filtering (PAN-DB).

Practice this question →

47

MCQeasy

What is the primary benefit of using Content-ID in a security policy?

A.It blocks malicious URLs.

B.It prioritizes traffic for specific applications.

C.It enables threat prevention and file blocking on allowed applications.

D.It identifies applications regardless of port.

AnswerC

Content-ID inspects permitted traffic for threats and files, satisfying the stem's requirement to identify the primary benefit. Unlike App-ID, which classifies applications, Content-ID operates after the application is allowed, applying antivirus, anti-spyware and file-blocking profiles. This layered inspection prevents malicious content traversing sanctioned applications.

Why this answer

Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Exam trap

Palo Alto Networks often tests the distinction between App-ID (application identification) and Content-ID (content inspection), and the trap here is confusing Content-ID with URL filtering or QoS, leading candidates to pick options that describe functions of other features.

How to eliminate wrong answers

Option A is wrong because blocking malicious URLs is the function of URL Filtering, not Content-ID; Content-ID inspects the content of allowed application traffic, not the URL. Option B is wrong because prioritizing traffic for specific applications is the function of QoS (Quality of Service) policies, which can be based on App-ID, but Content-ID does not handle traffic prioritization. Option D is wrong because identifying applications regardless of port is the primary function of App-ID, which uses protocol decoders and signatures to identify applications, not Content-ID.

Practice this question →

48

MCQmedium

An administrator wants to block upload of files with extension .exe to the application 'box-net'. Which security policy component is most appropriate?

A.Data Filtering profile

B.Application filter in security rule

C.URL Filtering profile

D.File Blocking profile

AnswerD

A File Blocking profile inspects traffic by file type and direction, letting you block specific extensions such as .exe on upload while permitting downloads. Applied to the box-net application, it directly satisfies the requirement to prevent .exe uploads, unlike URL Filtering or App-ID rules, which cannot match file extensions.

Why this answer

The File Blocking profile is the correct choice because it is specifically designed to block files based on type (e.g., .exe) within allowed applications like 'box-net'. This profile works with App-ID to enforce content-level control, preventing the upload of executable files while still permitting the application's traffic.

Exam trap

The trap here is that candidates often confuse File Blocking with Data Filtering, but Data Filtering is for data patterns (e.g., SSNs), not file types, while File Blocking specifically targets file extensions and types.

How to eliminate wrong answers

Option A is wrong because Data Filtering profile controls the transfer of sensitive data patterns (e.g., credit card numbers) via predefined or custom signatures, not file extensions. Option B is wrong because an Application filter in a security rule controls which applications are allowed or denied, not the specific file types within an allowed application. Option C is wrong because URL Filtering profile manages access to websites based on URL categories, not file upload restrictions within an application.

Practice this question →

49

MCQmedium

Which of the following is a prerequisite for App-ID to identify applications in encrypted traffic?

A.Configure a custom application signature.

B.Enable SSL decryption.

C.Ensure the security rule allows the application.

D.Enable App-ID on the security rule.

AnswerB

App-ID inspects application payloads and TLS handshake metadata, which are opaque inside encrypted sessions. Enabling SSL decryption lets the firewall terminate and inspect traffic, providing the visibility App-ID requires to identify applications. Without decryption, only certificate-based heuristics remain available.

Why this answer

App-ID identifies applications by analyzing traffic patterns, including those in encrypted flows. However, to inspect the content of encrypted traffic (e.g., HTTPS), the firewall must first decrypt it using SSL decryption. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is insufficient for accurate identification of many modern applications that use encryption.

Exam trap

The trap here is that candidates often assume App-ID can identify all applications purely from metadata or signatures without needing decryption, but the exam tests that SSL decryption is a prerequisite for accurate identification of applications in encrypted traffic.

How to eliminate wrong answers

Option A is wrong because configuring a custom application signature is not a prerequisite for App-ID to identify applications in encrypted traffic; custom signatures are used for proprietary or non-standard applications, but App-ID can still identify many encrypted applications via other methods (e.g., JA3 fingerprinting) without custom signatures. Option C is wrong because ensuring the security rule allows the application is a consequence of identification, not a prerequisite; the rule must first be configured to allow traffic, but App-ID identification happens before rule matching. Option D is wrong because enabling App-ID on the security rule is a configuration step to activate App-ID processing, but it does not enable decryption; without SSL decryption, App-ID cannot see the encrypted payload to identify the application.

Practice this question →

50

MCQeasy

A small business owner wants to block all social media applications during work hours for employees. The firewall is configured with App-ID and has a security rule that denies the 'social-networking' application category from the internal zone to the internet zone. However, employees are still able to access Facebook and Twitter. The traffic logs show these applications are being allowed by a different rule. The administrator checks the security policy and finds the deny rule for social-networking is present but not matched. What is the most likely reason the deny rule is not being matched?

A.There is a rule above the deny rule that allows all traffic.

B.The source IP address range does not include the employees' subnet.

C.The source zone is set to 'any' but the actual traffic is coming from a different zone than assumed.

D.The security rule does not have a URL Filtering profile attached.

AnswerA

Palo Alto Networks evaluates security rules top-down, stopping at the first match. A permissive rule placed above the social-networking deny rule therefore matches Facebook and Twitter traffic first, so the deny rule is never reached. Reordering the policy, or narrowing the upper rule, restores enforcement.

Why this answer

The most likely reason the deny rule is not matched is that a higher-priority rule (placed above the deny rule) is allowing all traffic, including social networking. In Palo Alto firewalls, security rules are evaluated from top to bottom; the first matching rule is applied. Even if a deny rule exists for social-networking, if a preceding rule allows all traffic, the deny rule is never evaluated.

The traffic logs indicate that the applications are allowed by a different rule, which supports this explanation.

Exam trap

A common mistake is to focus on zone or IP configuration when the actual issue is rule order. Always check if there is a higher-priority rule allowing the traffic before concluding that the deny rule's settings are incorrect.

How to eliminate wrong answers

Option A is wrong because if a rule above the deny rule allowed all traffic, the deny rule would never be reached, but the question states the deny rule is present but not matched, implying it is evaluated but fails to match; a rule allowing all traffic would still be matched, not cause the deny rule to be unmatched. Option B is wrong because the source IP address range not including the employees' subnet would cause the rule to not match, but the question specifies the rule is placed at the top and the traffic logs show the applications are allowed by a different rule, indicating the issue is zone-based, not IP-based; App-ID rules match on zone first, then IP, so a zone mismatch is more likely. Option D is wrong because URL Filtering profiles are used for URL-based blocking, not for blocking applications via App-ID; App-ID identifies applications by their traffic patterns and signatures, and a security rule denying the 'social-networking' category does not require a URL Filtering profile to match or block the application.

Practice this question →

Ready to test yourself?

Try a timed practice session using only App-ID and Content-ID questions.

Start 20-question session

CCNA App-ID and Content-ID Questions | Courseiva