PCNSE Securing Traffic and App-ID Practice Question
A large enterprise uses a custom application that communicates over TCP port 8080 using HTTP. The application traffic is correctly identified as 'custom-app' by App-ID. Recently, the development team changed the application to use HTTPS on the same port. The firewall administrator updated the security policy to allow the application, using the same application name, but now the traffic is being denied. The firewall logs show the application as 'ssl' and the action 'deny'. The security policy has a rule that allows 'custom-app' from inside to outside. What should the administrator do to resolve this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the custom application definition to include SSL decryption and a hostname match.
Since the application changed from HTTP to HTTPS on the same port, App-ID now identifies it as 'ssl' instead of 'custom-app' because the traffic is encrypted. To have App-ID recognize the encrypted traffic as the custom application, the administrator must update the custom application definition to include SSL decryption (so the firewall can inspect the encrypted payload) and a hostname match (to distinguish this specific application from other SSL traffic). This allows the existing security policy rule that allows 'custom-app' to match the traffic. Option A is incorrect because an application override would bypass App-ID entirely, reducing visibility and security. Option B is incorrect because disabling App-ID and using port-based policy loses application awareness and security. Option C is incorrect because changing the rule to allow 'ssl' would permit all SSL traffic on port 8080, which is overly permissive and a security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an application override for the traffic on port 8080.
Why it's wrong here
This bypasses App-ID and does not leverage application identification.
- ✗
Disable App-ID for that traffic and use a port-based policy.
Why it's wrong here
This removes application visibility and is not recommended.
- ✗
Change the security policy rule to allow application 'ssl' instead.
Why it's wrong here
This would allow all SSL traffic, not just the custom application, creating a security risk.
- ✓
Update the custom application definition to include SSL decryption and a hostname match.
Why this is correct
This enables the firewall to decrypt and identify the HTTPS traffic as the custom application.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.