PCNSE Securing Traffic and App-ID Practice Question
A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?
⚠ Common exam trap
The trap here is that candidates often focus on App-ID configuration (options A or B) rather than recognizing that the fundamental issue is rule ordering, which is a core concept in Palo Alto Networks policy evaluation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reorder the security rules so the custom allow rule is above the deny rule.
Security rules in Palo Alto Networks firewalls are evaluated in top-down order, and the first matching rule is applied. Since the deny rule appears before the custom allow rule, all traffic matching the deny rule's criteria (including the custom application) is blocked before reaching the allow rule. Reordering the rules so the custom allow rule is above the deny rule ensures the custom application traffic is permitted as intended.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the custom App-ID signature to match more precisely.
Why it's wrong here
The signature is properly defined; the issue is not identification but policy order.
- ✗
Create an application override for the custom application.
Why it's wrong here
An application override is not needed since the signature already identifies the application correctly.
- ✗
Add a virtual wire interface to ensure traffic reaches the firewall.
Why it's wrong here
The traffic is already reaching the firewall and being logged; connectivity is not the issue.
- ✓
Reorder the security rules so the custom allow rule is above the deny rule.
Why this is correct
Placing the more specific allow rule before the broad deny rule ensures the traffic matches the correct rule.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.