PCNSE Securing Traffic and App-ID Practice Question
A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?
⚠ Common exam trap
Candidates often assume App-ID is instant and always correct on the first packet, but PCNSE tests the understanding that App-ID may require multiple packets to fully identify an application, leading to a temporary 'unknown-tcp' classification that can match a deny rule before the correct application is recognized.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.
App-ID uses a multi-pass approach: the first packet is classified based on IP/port, but the application may not be fully identified until several packets are inspected. If the trading application uses a dynamic or non-standard handshake, some sessions may not be recognized as 'trading-app' before the security policy is evaluated, causing them to fall back to 'unknown-tcp' and match the deny rule. This sporadic behavior explains why only some sessions are dropped even though the application is eventually identified correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.
Why this is correct
Inconsistent identification can occur if the application signature does not match all variations of the traffic.
- ✗
The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.
Why it's wrong here
App-ID does not assign multiple identities to a single session.
- ✗
The traffic is using a non-standard port, so the standard rule does not match.
Why it's wrong here
The traffic uses default port 5000, so port is not the issue.
- ✗
There is a decryption policy causing the application to be misidentified.
Why it's wrong here
No decryption policy is mentioned; the traffic is likely not encrypted.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.