PCNSA App-ID and Content-ID Practice Question
During a security audit, it is discovered that some users are bypassing the company's web proxy by using HTTPS to external websites. The firewall is configured to allow 'web-browsing' application. What is the best way to enforce proxy usage for all HTTP/HTTPS traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing.
By blocking the 'web-browsing' application for regular users and allowing only the proxy server to use it, you enforce that all HTTP/HTTPS traffic must go through the proxy. SSL decryption (A) helps inspect encrypted traffic but does not force proxy usage. Content-ID (C) is not used to block entire categories like web traffic; it focuses on threat signatures. URL filtering (D) can block or allow specific URLs but does not enforce proxy routing; users could still bypass the proxy using different URLs or IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL decryption and block traffic that is not decrypted.
Why it's wrong here
SSL decryption alone does not force proxy use.
- ✓
Create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing.
Why this is correct
This ensures users must go through the proxy.
- ✗
Configure Content-ID to block all web traffic.
Why it's wrong here
Content-ID is part of the solution but not sufficient alone.
- ✗
Use URL filtering to block all URLs except those from the proxy.
Why it's wrong here
URL filtering does not control proxy bypass.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.