PCNSA App-ID and Content-ID Practice Question
Exhibit
{
"rulebase": {
"security": [
{
"name": "allow-all",
"from": ["trust"],
"to": ["untrust"],
"source": ["any"],
"destination": ["any"],
"application": ["any"],
"action": "allow"
}
]
}
}Refer to the exhibit. An administrator wants to block all traffic that does not match a specific application (e.g., only allow 'web-browsing'). What should be done?
⚠ Common exam trap
Palo Alto Networks often tests the misconception that you can block all non-matching traffic by simply changing the action of the existing rule to 'deny' without adding a separate allow rule above it, but that would block everything including the desired application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change action to 'deny' and create a new rule with application ['web-browsing'] above it.
To enforce an allow-list approach for a specific application like 'web-browsing', you must first create a rule that denies all traffic (action 'deny') and then place a higher-priority rule above it that explicitly allows only 'web-browsing'. This ensures that any traffic not matching the allowed application is blocked by the default-deny rule, leveraging App-ID's ability to identify applications regardless of port or protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a file blocking profile.
Why it's wrong here
File blocking blocks file types, not applications.
- ✗
Change application to ['unknown-tcp', 'unknown-udp'].
Why it's wrong here
That would only block unidentified traffic, not all non-web-browsing apps.
- ✗
Change category to ['misccategory'].
Why it's wrong here
Categories are not used to block applications.
- ✓
Change action to 'deny' and create a new rule with application ['web-browsing'] above it.
Why this is correct
A deny-all rule at the bottom with specific allow rules above is best practice.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.