PCNSE Core Concepts and Architecture Practice Question
A network engineer is configuring App-ID for a custom application that uses a proprietary protocol over TCP port 12345. The application's traffic is not being identified as expected. Which configuration change should the engineer make to ensure the firewall correctly identifies this application?
⚠ Common exam trap
It's easy for candidates to confuse 'application override' (which disables App-ID) with 'custom application' (which enhances App-ID), leading them to choose option A when they should instead define a new application object with the correct port and signature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a custom application with the appropriate protocol, port, and optionally a signature.
When a custom application uses a proprietary protocol over a non-standard port, the firewall cannot rely on its built-in App-ID signatures. By defining a custom application object with the correct protocol (TCP), port (12345), and optionally a protocol-level signature (e.g., a byte pattern or sequence), the firewall can accurately identify the traffic. This ensures that App-ID can match the traffic even if the port is not commonly associated with any known application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a security policy rule with an application override to match the port.
Why it's wrong here
Application override skips App-ID and treats the traffic as the specified application; it does not help the firewall learn the custom app.
- ✓
Define a custom application with the appropriate protocol, port, and optionally a signature.
Why this is correct
Custom application objects allow the firewall to identify the traffic based on port and/or signature.
- ✗
Enable SSL decryption on the traffic to inspect encrypted payloads.
Why it's wrong here
Decryption is for SSL/TLS; the protocol is proprietary and may not be encrypted.
- ✗
Add the port to the default application's 'port' field in the application object.
Why it's wrong here
Default applications are predefined; custom apps require a new definition.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.