PCNSE Securing Traffic and App-ID Practice Question
A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?
⚠ Common exam trap
Test-takers frequently confuse 'application override' (which bypasses App-ID) with 'custom App-ID' (which enhances App-ID), leading them to choose option C, thinking it will force identification when it actually disables App-ID for that traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.
App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.
Why this is correct
Custom App-IDs allow identification of proprietary protocols by defining signatures.
- ✗
Enable unknown application identification in the security rule.
Why it's wrong here
Unknown application identification identifies unknown applications, not custom ones.
- ✗
Use the default application override for port 4444 to allow traffic.
Why it's wrong here
Application override bypasses App-ID and is not a solution for identifying applications.
- ✗
Change the security rule to use 'application-default' as the service to rely on port-based identification.
Why it's wrong here
Application-default maps to default ports but does not help with custom application identification.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.