PCNSE Core Concepts and Architecture Practice Question
A company has a security policy rule that allows application 'ssl' from the internal zone to the external zone. Users report that they cannot access certain HTTPS websites. Logs show that the traffic is being matched by a later rule that denies application 'web-browsing'. The administrator verifies that the target websites are using standard HTTPS (port 443). The firewall's application identification has correctly identified the traffic as 'web-browsing' instead of 'ssl'. What is the most likely reason?
⚠ Common exam trap
Candidates often assume the application identification remains static after decryption, not realizing that Palo Alto firewalls re-evaluate the application post-decryption, which can cause traffic to match a different rule than the one that matched the initial encrypted session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's SSL decryption is enabled and re-identifies the application after decryption.
When SSL decryption is enabled, the firewall initially identifies the traffic as 'ssl' based on the SSL handshake. After decrypting the traffic, it re-inspects the HTTP payload and re-identifies the application as 'web-browsing'. This post-decryption re-identification causes the traffic to match a later rule that denies 'web-browsing', even though the initial rule allowed 'ssl'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application 'ssl' is only used for SSL control traffic, not encrypted payload.
Why it's wrong here
'ssl' is the application for the SSL/TLS protocol itself, but after decryption it changes.
- ✗
The security rule is misconfigured with the source zone incorrect.
Why it's wrong here
Source zone is likely correct as traffic is reaching the rule.
- ✓
The firewall's SSL decryption is enabled and re-identifies the application after decryption.
Why this is correct
After decryption, the firewall inspects the HTTP traffic and reclassifies it as 'web-browsing', which is then denied by a later rule.
- ✗
The firewall needs to have App-ID updated to recognize the websites.
Why it's wrong here
App-ID updates help but reclassification after decryption is expected.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.