Securing Traffic practice questions

Which TWO are valid methods to decrypt SSL/TLS traffic on a Palo Alto Networks firewall? (Choose two.)

Trap 1: IPsec Decryption

IPsec Decryption is used for decrypting IPsec VPN traffic, not SSL/TLS traffic. SSL/TLS operates at a different layer.

Trap 2: SSH Proxy

SSH Proxy decrypts SSH sessions, not SSL/TLS traffic. It is not a valid method for SSL/TLS decryption.

Trap 3: Decryption Mirror

Decryption Mirror forwards traffic to an external decryption device; it does not perform decryption itself on the firewall.

A
IPsec Decryption
Why wrong: IPsec Decryption is used for decrypting IPsec VPN traffic, not SSL/TLS traffic. SSL/TLS operates at a different layer.
B
SSH Proxy
Why wrong: SSH Proxy decrypts SSH sessions, not SSL/TLS traffic. It is not a valid method for SSL/TLS decryption.
C
SSL Inbound Inspection
Correct. SSL Inbound Inspection decrypts inbound SSL/TLS traffic destined for protected servers.
D
Decryption Mirror
Why wrong: Decryption Mirror forwards traffic to an external decryption device; it does not perform decryption itself on the firewall.
E
SSL Forward Proxy
Correct. SSL Forward Proxy decrypts outbound SSL/TLS traffic from internal clients.

Question 2hardmultiple choice

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

Trap 1: Create an allow rule for all users, then a deny rule for HR with…

This approach fails because the allow rule is placed first, so all traffic, including HR users attempting to access social media, will match the allow rule and be permitted. The subsequent deny rule will never be evaluated for traffic that already matched the allow rule. Additionally, it does not explicitly use User-ID to identify HR users dynamically.

Trap 2: Create a deny rule for the HR user group with application…

This approach places the deny rule with the correct order (before the allow rule). However, it is incorrect because it does not specify the source zone (corporate) and may rely on a static user group rather than dynamic User-ID identification. Without specifying the source zone, the rule could apply to traffic from other zones, potentially blocking unintended traffic, and it may not correctly identify the HR users if they are not part of a static group.

Trap 3: Use user-ID to identify HR users and create a deny rule with source…

This approach uses User-ID and correct conditions (source zone corporate, source user HR, application social-media), but places the deny rule after the allow rule. Due to top-down rule evaluation, the allow rule matches first, permitting access to social media for all users including HR, so the deny rule never applies.

A
Create an allow rule for all users, then a deny rule for HR with application social-media.
Why wrong: This approach fails because the allow rule is placed first, so all traffic, including HR users attempting to access social media, will match the allow rule and be permitted. The subsequent deny rule will never be evaluated for traffic that already matched the allow rule. Additionally, it does not explicitly use User-ID to identify HR users dynamically.
B
Create a deny rule for the HR user group with application social-media before the allow rule.
Why wrong: This approach places the deny rule with the correct order (before the allow rule). However, it is incorrect because it does not specify the source zone (corporate) and may rely on a static user group rather than dynamic User-ID identification. Without specifying the source zone, the rule could apply to traffic from other zones, potentially blocking unintended traffic, and it may not correctly identify the HR users if they are not part of a static group.
C
Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.
Why wrong: This approach uses User-ID and correct conditions (source zone corporate, source user HR, application social-media), but places the deny rule after the allow rule. Due to top-down rule evaluation, the allow rule matches first, permitting access to social media for all users including HR, so the deny rule never applies.
D
Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.
This approach correctly uses User-ID to dynamically identify HR users, specifies the source zone corporate and the application social-media, and places the deny rule before the allow rule. This ensures that traffic from HR users to social media is blocked by the deny rule, while all other traffic matches the subsequent allow rule.

Question 3mediummultiple choice

Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?

Exhibit

Refer to the exhibit.
Exhibit: CLI output from 'show running security-policy' shows:

```
set rulebase security rules "Allow_Web" from untrust to dmz source any destination 10.1.1.0/24 application web-browsing,ssl service tcp/80, tcp/443 action allow log-end
set rulebase security rules "Block_ALL" from any to any source any destination any application any service any action deny
```

Trap 1: Denied because the source is not specified in Allow_Web.

The rule specifies source any, so all sources from untrust are matched.

Trap 2: Denied by rule Block_ALL because it is the last rule.

The traffic matches the first rule Allow_Web, so it is allowed and never reaches Block_ALL.

Trap 3: Allowed by rule Allow_Web because application ssl matches.

Although ssl matches, the service tcp/443 also matches and is more explicit in this context.

A
Denied because the source is not specified in Allow_Web.
Why wrong: The rule specifies source any, so all sources from untrust are matched.
B
Denied by rule Block_ALL because it is the last rule.
Why wrong: The traffic matches the first rule Allow_Web, so it is allowed and never reaches Block_ALL.
C
Allowed by rule Allow_Web because service tcp/443 matches.
HTTPS uses tcp/443, and the rule allows that service along with application ssl.
D
Allowed by rule Allow_Web because application ssl matches.
Why wrong: Although ssl matches, the service tcp/443 also matches and is more explicit in this context.

Question 4mediummultiple choice

A network engineer is troubleshooting a drop in traffic from a critical application. The traffic is allowed by the security policy, but the firewall is dropping the packets. The engineer views the session log and sees that the session is being terminated due to 'tcp-non-syn'. What is the most likely cause?

Trap 1: The TCP sequence numbers are out of order, causing the packets to…

Out-of-order sequence numbers cause tcp-out-of-window drops, not tcp-non-syn.

Trap 2: The NAT policy is misconfigured, causing the source IP to not be…

NAT misconfiguration leads to NAT-related drops, not tcp-non-syn.

Trap 3: The security policy uses an incorrect service object that doesn't…

Incorrect service would cause application-mismatch, not tcp-non-syn.

A
The TCP sequence numbers are out of order, causing the packets to be out of the expected window.
Why wrong: Out-of-order sequence numbers cause tcp-out-of-window drops, not tcp-non-syn.
B
The NAT policy is misconfigured, causing the source IP to not be translated correctly.
Why wrong: NAT misconfiguration leads to NAT-related drops, not tcp-non-syn.
C
The security policy uses an incorrect service object that doesn't match the application.
Why wrong: Incorrect service would cause application-mismatch, not tcp-non-syn.
D
Asymmetric routing is causing packets to arrive at a firewall that did not see the initial SYN.
Asymmetric routing leads to tcp-non-syn drops because the firewall has no session for the non-SYN packet.

Read the full DNS explanation →

Question 5easymultiple choice

An organization wants to prevent data exfiltration via DNS tunneling. Which security profile should be applied to the outbound DNS traffic?

Trap 1: Vulnerability Protection profile

Vulnerability Protection blocks exploits, not DNS tunneling.

Trap 2: URL Filtering profile

URL Filtering is for web traffic, not DNS.

Trap 3: Anti-Spyware profile

Anti-Spyware is for malware C2, not specifically DNS tunneling.

A
DNS Security profile
DNS Security is designed to detect and block DNS tunneling.
B
Vulnerability Protection profile
Why wrong: Vulnerability Protection blocks exploits, not DNS tunneling.
C
URL Filtering profile
Why wrong: URL Filtering is for web traffic, not DNS.
D
Anti-Spyware profile
Why wrong: Anti-Spyware is for malware C2, not specifically DNS tunneling.

Review the full routing breakdown →

Question 6hardmultiple choice

A company has a firewall configured with multiple virtual routers. A user on a trusted network can ping the firewall's management IP but cannot reach an external server. The security policy allows the traffic. What is the most likely cause?

Trap 1: A zone protection profile is blocking ICMP packets.

Zone protection would block based on flood protection, not routing.

Trap 2: The decryption policy is blocking the traffic because it is not…

Decryption applies to SSL/TLS, not ICMP.

Trap 3: The NAT policy is missing for the outbound traffic.

NAT is often needed but routing is more fundamental; the question says security policy allows but doesn't mention NAT.

A
A zone protection profile is blocking ICMP packets.
Why wrong: Zone protection would block based on flood protection, not routing.
B
The virtual router does not have a default route to the external network.
Without a route, the firewall cannot forward packets to the destination.
C
The decryption policy is blocking the traffic because it is not decrypted.
Why wrong: Decryption applies to SSL/TLS, not ICMP.
D
The NAT policy is missing for the outbound traffic.
Why wrong: NAT is often needed but routing is more fundamental; the question says security policy allows but doesn't mention NAT.

Question 7easymultiple choice

When configuring a security policy rule to allow HTTP traffic from the internal zone to the external zone, which mandatory components must be defined?

Trap 1: Source Zone, Destination Zone, Application, and User

User is optional.

Trap 2: Source Zone, Destination Zone, Application, and Service

Service is not mandatory; application is.

Trap 3: Source Zone, Destination Zone, Service, and Action

Application is needed, service is optional.

A
Source Zone, Destination Zone, Application, and User
Why wrong: User is optional.
B
Source Zone, Destination Zone, Application, and Service
Why wrong: Service is not mandatory; application is.
C
Source Zone, Destination Zone, Service, and Action
Why wrong: Application is needed, service is optional.
D
Source Zone, Destination Zone, Source Address, Destination Address, Application, and Action
These are the minimum required fields in a security policy rule.

Question 8mediummultiple choice

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Trap 1: Configure a Source NAT rule to translate the mail server's IP to…

Source NAT is for outbound traffic, not inbound.

Trap 2: Configure a security policy rule with source NAT to translate the…

Source NAT is not used for inbound traffic; it changes source IP.

Trap 3: Configure a security policy rule allowing SMTP from external to DMZ…

Without NAT, the destination IP is the public IP, but the mail server has a private IP; traffic won't reach it.

A
Configure a Source NAT rule to translate the mail server's IP to the public IP.
Why wrong: Source NAT is for outbound traffic, not inbound.
B
Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.
Destination NAT translates the public IP to the private IP, and the policy allows the traffic.
C
Configure a security policy rule with source NAT to translate the public IP to the private IP.
Why wrong: Source NAT is not used for inbound traffic; it changes source IP.
D
Configure a security policy rule allowing SMTP from external to DMZ without NAT.
Why wrong: Without NAT, the destination IP is the public IP, but the mail server has a private IP; traffic won't reach it.

Read the full DNS explanation →

Question 9hardmulti select

Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)

Trap 1: Allow all TCP traffic on port 53.

TCP DNS can also be used for tunneling.

Trap 2: Enable logging on all DNS traffic for analysis.

Logging does not prevent tunneling.

Trap 3: Block all UDP traffic on port 53.

This would block legitimate DNS and cause outages.

A
Enable DNS Security on the outbound DNS traffic.
DNS Security detects tunneling attempts.
B
Configure DNS policies to block requests to unknown domains.
This restricts DNS to known domains only.
C
Allow all TCP traffic on port 53.
Why wrong: TCP DNS can also be used for tunneling.
D
Enable logging on all DNS traffic for analysis.
Why wrong: Logging does not prevent tunneling.
E
Block all UDP traffic on port 53.
Why wrong: This would block legitimate DNS and cause outages.

Question 10hardmultiple choice

A financial services company uses a Palo Alto Networks PA-5220 firewall in an active/passive HA pair at their headquarters. They have a single zone 'Trust-LAN' for internal users and a single zone 'Untrust-WAN' for internet traffic. The security policy currently includes a rule that allows all outbound HTTP/HTTPS traffic from 'Trust-LAN' to 'Untrust-WAN' with no security profiles applied. Recently, users have been complaining about slow internet performance, and the IT team suspects malware or botnet activity. The firewall's logs show numerous sessions to known malicious IPs, but the firewall is not blocking them. The network architect decides to implement URL Filtering and Threat Prevention profiles on the outbound rule. However, after committing the changes, some users report that legitimate websites (e.g., online banking, cloud apps) are being blocked. The IT team verifies that the URL Filtering profile is set to 'alert' for all categories except 'malware' which is 'block', and the Threat Prevention profile is set to 'default' action. What is the most likely cause of the legitimate website blocking?

Trap 1: The security rule order is incorrect; a deny rule above the allow…

The issue is not about rule order; the allow rule is still in place.

Trap 2: The URL Filtering profile is applied at the zone level, not per…

URL profiles are applied per rule, not per zone.

Trap 3: The firewall has insufficient memory to process URL lookups and is…

Resource exhaustion is unlikely; the firewall should handle the load.

A
The URL Filtering profile's 'uncategorized' category is set to 'block', blocking sites not in the URL database.
This is a common cause: uncategorized URLs are blocked by default if the action is not 'alert'.
B
The security rule order is incorrect; a deny rule above the allow rule is blocking legitimate traffic.
Why wrong: The issue is not about rule order; the allow rule is still in place.
C
The URL Filtering profile is applied at the zone level, not per rule, causing all traffic to be filtered.
Why wrong: URL profiles are applied per rule, not per zone.
D
The firewall has insufficient memory to process URL lookups and is dropping packets.
Why wrong: Resource exhaustion is unlikely; the firewall should handle the load.

Question 11hardmultiple choice

A security administrator notices traffic from an internal user to a known malicious IP address in the corporate network. The traffic is allowed despite a security rule that blocks traffic to that IP. The rule is in a rulebase with multiple rules, and the administrator verifies that the malicious IP is correctly listed in a custom object used by the rule. What is the most likely cause of this issue?

Trap 1: The security profile group applied to the rule is blocking the…

Security profiles are applied after rule matching; they do not prevent the rule from matching.

Trap 2: The custom object containing the malicious IP was not committed.

The administrator verified the custom object is correct; if it were not committed, the rule would not match but the traffic would still be allowed by a different rule.

Trap 3: The device clock is out of sync, causing time-based rules to fail.

Time synchronization does not affect rule matching for static IP addresses.

A
The security profile group applied to the rule is blocking the traffic before the rule is evaluated.
Why wrong: Security profiles are applied after rule matching; they do not prevent the rule from matching.
B
The custom object containing the malicious IP was not committed.
Why wrong: The administrator verified the custom object is correct; if it were not committed, the rule would not match but the traffic would still be allowed by a different rule.
C
A rule with a broader match exists above the blocking rule in the rulebase.
Rules are evaluated from top to bottom; a rule above that matches the traffic will apply, bypassing the blocking rule.
D
The device clock is out of sync, causing time-based rules to fail.
Why wrong: Time synchronization does not affect rule matching for static IP addresses.

Question 12mediummulti select

Which TWO actions can be taken in a security policy rule to allow traffic from the corporate network to the internet while also logging the traffic?

Trap 1: Set the rule action to 'reset-both'.

Reset-both terminates the session and sends TCP resets.

Trap 2: Set the rule action to 'deny'.

Deny blocks traffic.

Trap 3: Enable 'Log at Session Start' in the rule.

Logging at session start is optional and not required for logging; session end provides standard logging.

A
Set the rule action to 'reset-both'.
Why wrong: Reset-both terminates the session and sends TCP resets.
B
Set the rule action to 'allow'.
Allow permits traffic through the firewall.
C
Set the rule action to 'deny'.
Why wrong: Deny blocks traffic.
D
Enable 'Log at Session Start' in the rule.
Why wrong: Logging at session start is optional and not required for logging; session end provides standard logging.
E
Enable 'Log at Session End' in the rule.
This logs the session after it completes, providing a record of allowed traffic.

Question 13easymultiple choice

Refer to the exhibit. A user at IP 10.10.10.10 tries to browse to http://192.0.2.50. Which rule matches this traffic?

Exhibit

Refer to the exhibit.

admin@PA-5050> show running security-policy

  name                      from     to       source          destination  application  service    action
  ------------------------  -------  -------  --------------  -----------  ------------  ---------  -------
  1 allow-web               trust    untrust  10.0.0.0/8      192.0.2.0/24 web-browsing  http       allow
  2 block-malware           trust    untrust  any             any          any           any        deny
  3 allow-dns               trust    untrust  any             any          dns           udp/53     allow

  Total rules: 3

Trap 1: Rule 3 (allow-dns)

Rule 3 only matches DNS traffic, not web-browsing.

Trap 2: Rule 2 (block-malware)

Rule 2 is evaluated after rule 1, so it does not apply.

Trap 3: No rule matches; traffic is denied by default.

Rule 1 matches explicitly.

A
Rule 3 (allow-dns)
Why wrong: Rule 3 only matches DNS traffic, not web-browsing.
B
Rule 2 (block-malware)
Why wrong: Rule 2 is evaluated after rule 1, so it does not apply.
C
Rule 1 (allow-web)
The traffic matches all criteria in rule 1 and is allowed.
D
No rule matches; traffic is denied by default.
Why wrong: Rule 1 matches explicitly.

Question 14mediumdrag order

Drag and drop the steps to perform a packet capture (tcpdump) on a Palo Alto Networks firewall using the CLI into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Stop the capture, then enter CLI, then issue tcpdump with filters,…

This is incorrect because you cannot stop a capture that hasn't been started; stopping occurs after issuing tcpdump and before exporting.

Trap 2: Enter CLI, then issue tcpdump with filters, then export the file,…

This is incorrect because exporting a file that is still being written to will result in an incomplete or corrupted capture; you must stop the capture before exporting.

Trap 3: Issue tcpdump with filters, then enter CLI, then stop the capture,…

This is incorrect because you cannot issue tcpdump commands before entering the CLI; CLI access is a prerequisite for any command execution.

A
Enter CLI, then issue tcpdump with filters, then stop the capture, then export the file.
This is the correct order because you must first access the CLI, then start a tcpdump session, stop it to finalize the capture file, and then export it for analysis.
B
Stop the capture, then enter CLI, then issue tcpdump with filters, then export the file.
Why wrong: This is incorrect because you cannot stop a capture that hasn't been started; stopping occurs after issuing tcpdump and before exporting.
C
Enter CLI, then issue tcpdump with filters, then export the file, then stop the capture.
Why wrong: This is incorrect because exporting a file that is still being written to will result in an incomplete or corrupted capture; you must stop the capture before exporting.
D
Issue tcpdump with filters, then enter CLI, then stop the capture, then export the file.
Why wrong: This is incorrect because you cannot issue tcpdump commands before entering the CLI; CLI access is a prerequisite for any command execution.

Question 15mediummatching

Match each PAN-OS component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Handles configuration and logging

Processes traffic and enforces policies

Manages routing and session setup

Aggregates logs from multiple firewalls

Trap 1: Management Plane: Processes and forwards network traffic based on…

This description belongs to the Data Plane, not Management Plane.

Trap 2: Data Plane: Handles device configuration, management access, and…

This description belongs to the Management Plane, not Data Plane.

A
Management Plane: Handles device configuration, management access, and logging.
Management Plane is responsible for device management.
B
Data Plane: Processes and forwards network traffic based on security policies.
Data Plane handles traffic forwarding.
C
Control Plane: Handles routing protocols, session setup, and other control functions.
Control Plane oversees routing and session establishment.
D
Management Plane: Processes and forwards network traffic based on security policies.
Why wrong: This description belongs to the Data Plane, not Management Plane.
E
Data Plane: Handles device configuration, management access, and logging.
Why wrong: This description belongs to the Management Plane, not Data Plane.

Question 16easymultiple choice

A network administrator wants to allow HTTP and HTTPS traffic from untrust zone to DMZ zone for a web server, but block all other traffic. What is the most efficient way to achieve this with a single rule?

Trap 1: Create a security policy with source zone Untrust, destination zone…

'application default' allows all applications Palo Alto deems default, which is too broad and not specific to web-browsing and ssl.

Trap 2: Create a security policy with source zone Untrust, destination zone…

This allows all traffic and does not block anything else, defeating the purpose.

Trap 3: Create a security policy with source zone Untrust, destination zone…

Service-based rules are less secure as they rely only on ports; applications could be masqueraded.

A
Create a security policy with source zone Untrust, destination zone DMZ, application set to web-browsing and ssl, action allow.
This uses App-ID to precisely allow only web and SSL traffic, blocking everything else by default.
B
Create a security policy with source zone Untrust, destination zone DMZ, application default, action allow.
Why wrong: 'application default' allows all applications Palo Alto deems default, which is too broad and not specific to web-browsing and ssl.
C
Create a security policy with source zone Untrust, destination zone DMZ, service any, application any, action allow.
Why wrong: This allows all traffic and does not block anything else, defeating the purpose.
D
Create a security policy with source zone Untrust, destination zone DMZ, service tcp/80 and tcp/443, action allow.
Why wrong: Service-based rules are less secure as they rely only on ports; applications could be masqueraded.

Question 17mediummultiple choice

A company is experiencing performance issues due to large amounts of encrypted traffic. They want to offload decryption to a dedicated appliance but still maintain visibility. Which feature should they configure on the Palo Alto Networks firewall?

Trap 1: SSL Forward Proxy with decryption mirroring.

Decryption mirroring copies traffic for analysis but does not offload decryption processing.

Trap 2: Decryption port mirroring.

Port mirroring copies traffic but does not offload decryption processing.

Trap 3: TLS 1.3 decryption.

TLS 1.3 is a protocol; enabling it does not offload decryption to another appliance.

A
SSL Decryption with a dedicated decryption broker.
A decryption broker offloads SSL/TLS decryption to a dedicated appliance, reducing firewall load while maintaining visibility.
B
SSL Forward Proxy with decryption mirroring.
Why wrong: Decryption mirroring copies traffic for analysis but does not offload decryption processing.
C
Decryption port mirroring.
Why wrong: Port mirroring copies traffic but does not offload decryption processing.
D
TLS 1.3 decryption.
Why wrong: TLS 1.3 is a protocol; enabling it does not offload decryption to another appliance.

Question 18easymultiple choice

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Trap 1: URL filtering profile only.

URL filtering only controls web categories, not malware or exploits.

Trap 2: No profile is needed; default settings suffice.

Default settings do not inspect traffic for threats.

Trap 3: Antivirus profile only.

Only antivirus misses other threats like spyware and vulnerabilities.

A
URL filtering profile only.
Why wrong: URL filtering only controls web categories, not malware or exploits.
B
Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.
A security profile group provides layered protection and is optimized for performance.
C
No profile is needed; default settings suffice.
Why wrong: Default settings do not inspect traffic for threats.
D
Antivirus profile only.
Why wrong: Only antivirus misses other threats like spyware and vulnerabilities.

Read the full NAT/PAT explanation →

Question 19mediummultiple choice

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Trap 1: Bidirectional NAT.

Bidirectional NAT combines source and destination NAT, but not typically used for outbound internet with a pool.

Trap 2: Static NAT with source NAT.

Static NAT provides 1-to-1 mapping, not suitable for sharing a pool.

Trap 3: Destination NAT with port forwarding.

Destination NAT is used for inbound traffic, not outbound.

A
Dynamic IP and Port (DIPP) with source NAT.
DIPP translates internal IPs to public IPs with port multiplexing, suitable for outbound internet access.
B
Bidirectional NAT.
Why wrong: Bidirectional NAT combines source and destination NAT, but not typically used for outbound internet with a pool.
C
Static NAT with source NAT.
Why wrong: Static NAT provides 1-to-1 mapping, not suitable for sharing a pool.
D
Destination NAT with port forwarding.
Why wrong: Destination NAT is used for inbound traffic, not outbound.

Question 20hardmultiple choice

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Trap 1: Enable SSL Decryption to inspect encrypted traffic.

While SSL decryption helps visibility, it does not fix incorrect App-ID signatures.

Trap 2: Change the security policy to use port-based rules instead of…

Port-based rules are less accurate and defeat the purpose of App-ID; this would not improve identification.

Trap 3: Create custom application signatures for the misidentified…

Custom signatures are a last resort; first ensure updates and built-in identification are correct.

A
Enable SSL Decryption to inspect encrypted traffic.
Why wrong: While SSL decryption helps visibility, it does not fix incorrect App-ID signatures.
B
Change the security policy to use port-based rules instead of application-based.
Why wrong: Port-based rules are less accurate and defeat the purpose of App-ID; this would not improve identification.
C
Create custom application signatures for the misidentified applications.
Why wrong: Custom signatures are a last resort; first ensure updates and built-in identification are correct.
D
Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.
Updating App-ID and using enhancements like application override can correct misidentification.