PCNSA App-ID and Content-ID Practice Question
During a security audit, it is discovered that FTP traffic over non-standard ports is bypassing App-ID inspection. What is the most effective method to ensure all FTP traffic is identified, regardless of port?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Application Override rule for FTP on the required source and destination addresses.
The most effective method is to create an Application Override rule for FTP, which forces App-ID to identify traffic as FTP based on source/destination addresses, regardless of port. Option A is wrong because updating databases does not change detection on non-standard ports; App-ID relies on port-based signatures unless overridden. Option B is wrong because disabling App-ID removes all application inspection. Option C is wrong because adding a non-standard port to the FTP service definition does not automatically enable App-ID identification; service definitions are used for policy enforcement, not for application identification. Option D is correct because an Application Override rule explicitly tells the firewall to treat traffic that matches the source and destination addresses as the specified application, bypassing port-based detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Update the App-ID and threat databases to the latest version.
Why it's wrong here
Databases do not change detection on non-standard ports.
- ✗
Set the security policy to 'allow' without App-ID to ensure FTP works.
Why it's wrong here
This would bypass all application inspection.
- ✗
Add the non-standard port to the FTP service definition.
Why it's wrong here
Service definition alone does not guarantee App-ID identification.
- ✓
Create an Application Override rule for FTP on the required source and destination addresses.
Why this is correct
Application Override forces App-ID to treat the traffic as FTP.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.