PCNSE Securing Traffic and App-ID Practice Question
A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?
⚠ Common exam trap
Candidates often confuse 'application override' (which bypasses App-ID) with 'custom application signature' (which enhances App-ID), leading them to choose options that disable inspection rather than improve it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom application with a data pattern (signature).
Creating a custom application with a data pattern (signature) allows the firewall to identify the ERP traffic based on its unique payload characteristics, without overriding or disabling the default App-ID engine. This approach uses a custom App-ID signature that matches the proprietary protocol's data pattern, ensuring accurate identification while the default engine continues to process other traffic normally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a port-based application override for port 4444.
Why it's wrong here
Port-based overrides bypass App-ID and do not improve identification accuracy.
- ✗
Enable SSL decryption for the ERP traffic.
Why it's wrong here
The ERP protocol is proprietary and not SSL, so decryption would not help.
- ✓
Create a custom application with a data pattern (signature).
Why this is correct
Custom applications with data patterns allow App-ID to identify proprietary protocols by inspecting payload content.
- ✗
Create an application override to allow the traffic without App-ID.
Why it's wrong here
Application override prevents App-ID from identifying the traffic, which is not desired.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.