PCNSE Core Concepts and Architecture Practice Question
A company runs a mixed environment of physical and virtual Palo Alto Networks firewalls (PA-5250, VM-300) managed by a single Panorama. The company recently deployed a new application that uses the QUIC protocol (UDP 443) for performance. After the deployment, the security team notices that the firewall is not accurately identifying the QUIC traffic, and some QUIC sessions are being dropped unexpectedly. The firewall logs show 'application: incomplete' for these sessions. The security team wants to ensure QUIC traffic is properly identified and allowed. The team has configured a security policy rule to allow 'ssl' application (thinking QUIC is similar to SSL) but the problem persists. The firewall is running PAN-OS 10.1. Which of the following is the best course of action?
⚠ Common exam trap
Many exam-takers assume QUIC is a variant of SSL/TLS and can be allowed by the 'ssl' application, but they overlook that QUIC runs over UDP and has its own distinct App-ID, requiring a separate security rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a security policy rule to allow the 'quic' application.
The correct action is to add a security policy rule allowing the 'quic' application because QUIC is a distinct protocol (UDP 443) with its own App-ID in PAN-OS 10.1. The firewall logs showing 'application: incomplete' indicate that App-ID is failing to identify the traffic, often due to a missing rule for the specific application. Allowing 'ssl' does not work because SSL/TLS operates over TCP, while QUIC uses UDP, and the firewall's App-ID engine treats them separately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a security policy rule to allow the 'quic' application.
Why this is correct
Allowing the quic application directly ensures proper identification and handling.
- ✗
Upgrade Panorama to the latest version to add QUIC support.
Why it's wrong here
The firewall already supports QUIC; Panorama version is not the issue.
- ✗
Enable SSL decryption on the policy to inspect QUIC traffic.
Why it's wrong here
QUIC is not SSL; decryption is for SSL/TLS only.
- ✗
Disable App-ID for the QUIC traffic and use a port-based rule.
Why it's wrong here
Disabling App-ID removes security visibility and control.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.