PCNSE App-ID Practice Question
A network engineer is deploying a new firewall to inspect traffic between two VLANs. The requirement is to block all traffic except HTTP and HTTPS from the internal network to a specific web server in the DMZ. The engineer applies a security policy with the following configuration: source zone Internal, destination zone DMZ, source address internal_subnet, destination address web_server, application set to 'web-browsing' and 'ssl', and action set to 'allow'. However, users report that they cannot access the web server. Which change must be made to the policy to resolve the issue?
⚠ Common exam trap
Candidates often assume that App-ID requires service objects for layer 4 matching, but in Palo Alto firewalls, App-ID identifies applications independently of port. The real trap is forgetting that rule ordering (priority) determines which rule applies when multiple rules match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the security policy rule to a higher priority in the rulebase
The security policy uses App-ID to identify web-browsing and ssl applications, which does not require explicit service objects. The most likely reason users cannot access the web server is that another rule with a higher priority (lower in the rulebase order) is blocking the traffic. Moving this allow rule to a higher priority ensures it is evaluated before any blocking rules, allowing the traffic to pass.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the service objects for HTTP (tcp/80) and HTTPS (tcp/443) to the rule
Why it's wrong here
Adding service objects for HTTP and HTTPS is unnecessary because Palo Alto App-ID can identify these applications without relying on port numbers. The issue is not related to missing service objects.
- ✗
Configure source NAT on the internal zone
Why it's wrong here
Source NAT is used to translate internal IP addresses when traffic leaves the firewall, but this is not required for traffic between VLANs (internal to DMZ) unless specific address translation is needed. It does not address the access issue.
- ✗
Create a separate rule for HTTP and another for HTTPS
Why it's wrong here
Creating separate rules for HTTP and HTTPS is redundant. A single rule with both applications is valid and should work if the rule is evaluated properly.
- ✓
Move the security policy rule to a higher priority in the rulebase
Why this is correct
Moving the rule to a higher priority ensures it is evaluated before any other rules that might block the traffic. This is the correct fix if a blocking rule with higher priority is currently matching and denying the traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.