PCNSA App-ID and Content-ID Practice Question
Which TWO of the following are true about App-ID? (Choose two.)
⚠ Common exam trap
Candidates often assume App-ID relies on port numbers for identification, similar to traditional firewalls, but the exam tests the understanding that App-ID is port-agnostic and uses deep packet inspection to identify applications regardless of the port used.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
App-ID identifies applications regardless of port.
Option B is correct because App-ID performs application identification independent of the TCP/UDP port in use, so an application running on a non-standard port is still recognized rather than being assumed from its port number. Option C is correct because App-ID combines multiple identification techniques — application signatures, protocol decoding, and behavioral/heuristic analysis — to accurately classify traffic, including evasive applications. Option A is incorrect because App-ID supports custom application signatures, allowing administrators to define and identify proprietary or internal applications. Option D is incorrect because App-ID is explicitly not limited to standard ports; port-independent identification is a core design goal of App-ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
App-ID cannot identify custom applications.
Why it's wrong here
App-ID identifies custom applications through custom signatures and application overrides, so this claim is false. It is tempting because App-ID's built-in signature database covers thousands of known applications, and custom identification does require extra configuration rather than working automatically.
- ✓
App-ID identifies applications regardless of port.
Why this is correct
App-ID decouples identification from TCP/UDP port numbers, so applications are recognised by their actual traffic characteristics rather than the port they happen to use. This satisfies the requirement that identification holds true even when applications run on non-standard or evasive ports.
- ✓
App-ID uses signatures, protocol decoding, and behavioral analysis to identify applications.
Why this is correct
App-ID combines multiple detection techniques: signature matching, protocol decoding and behavioural analysis. This layered approach satisfies the need to identify applications accurately, including those using encryption or evasive tactics that any single method alone would miss.
- ✗
App-ID can only identify applications on standard ports.
Why it's wrong here
App-ID identifies applications regardless of port, including those using non-standard or dynamically negotiated ports, so this restriction is false. It is tempting because many legacy firewalls classify traffic solely by port and protocol, making port-independence a genuine App-ID differentiator.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 385-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.