mediumMultiple SelectObjective-mapped
PCNSA Practice Question: Which TWO of the following are key benefits of…
Which TWO of the following are key benefits of using an Application-Based Security Policy compared to a Port-Based Security Policy? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ability to control applications regardless of port or protocol evasion
Options B and D are correct. Application-based policies use App-ID to identify and control applications regardless of the port or protocol used, preventing evasion via non-standard ports. They also provide detailed logging and reporting on application usage, aiding compliance. Option A is wrong because port-based policies are simpler for static protocols; application-based policies require more configuration. Option C is wrong because application-based policies do not inherently increase throughput; they perform deep inspection. Option E is wrong because application-based policies actually require more processing than simple port checking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Simpler configuration for traditional protocols like HTTP and FTP
Why it's wrong here
While Application-Based Security Policies identify traffic by application signatures and decryption, a Port-Based Policy relies on static L4 port numbers, which HTTP and FTP can easily use without application awareness. This option is tempting because for simple, well-known protocols, a port-based rule is indeed quicker to configure and troubleshoot. However, the question asks for benefits of application-based policy, which provides granular control over application functions—such as blocking specific FTP commands—that port-based rules cannot enforce.
- ✓
Ability to control applications regardless of port or protocol evasion
Why this is correct
Application-based policies can identify applications even if they use non-standard ports.
- ✗
Easier to allow applications that use dynamic ports
Why it's wrong here
Application-based policies allow dynamic ports, but port-based rules cannot easily handle them; however, this is a benefit but not listed as a key benefit compared to port-based.
- ✓
Ability to log and report on application usage for compliance
Why this is correct
Application-based policies provide detailed application-level logging and reporting.
- ✗
Increased throughput because firewall does not need to inspect ports
Why it's wrong here
Application inspection requires more processing, potentially decreasing throughput.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.