PCNSE Troubleshoot Practice Question
A large enterprise uses a PA-5250 as a perimeter firewall with multiple virtual systems (vsys). One vsys is for the DMZ, and it is logging high amounts of dropped traffic. The administrator notices that the firewall's dataplane CPU is consistently above 80%. The logs show many 'application-id timeout' drops. The DMZ hosts are running custom applications on non-standard ports. What is the first step to mitigate the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a custom application signature for the custom applications.
Creating custom application signatures reduces the need for heuristic analysis of unknown traffic, lowering CPU load.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable application identification for the DMZ zone.
Why it's wrong here
Disabling app-id entirely would break security policy that depends on application matching.
- ✗
Reduce the number of security rules in the DMZ.
Why it's wrong here
Fewer rules do not directly address the app-id processing overhead.
- ✓
Use a custom application signature for the custom applications.
Why this is correct
Custom app signatures allow the firewall to identify traffic without deep packet inspection, reducing CPU.
- ✗
Increase the application identification timeout for the custom applications.
Why it's wrong here
Increasing timeout would not reduce CPU; it may even allow more analysis time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.