PCNSE Securing Traffic and App-ID Practice Question
A network engineer is troubleshooting an issue where a web application is being incorrectly identified as 'web-browsing' instead of 'webmail-gmail' by the Palo Alto Networks firewall. The firewall has App-ID enabled and all signatures are up to date. Which TWO actions should the engineer take to resolve this misidentification?
⚠ Common exam trap
Many exam-takers assume a static, one-time identification and overlook the fact that App-ID can dynamically reclassify a session as more data is analyzed, making the session log a critical diagnostic tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the session log to see if the application changed during the session.
App-ID can reclassify a session as more data becomes available. A session that starts as 'web-browsing' may later be identified as 'webmail-gmail' once the firewall sees application-specific traffic (e.g., SMTP, IMAP, or proprietary Gmail API calls). Reviewing the session log to see if the application changed during the session helps confirm whether the firewall eventually identified the correct application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable unknown application identification to force stricter matching.
Why it's wrong here
Disabling unknown app identification does not correct misidentification of known apps.
- ✗
Create a custom App-ID for webmail-gmail with stricter signatures.
Why it's wrong here
Custom App-ID is unnecessary since webmail-gmail is already a known application.
- ✓
Review the session log to see if the application changed during the session.
Why this is correct
Session logs show App-ID updates; the application may have been re-identified later.
- ✗
Increase the application identification timeout to allow more time for identification.
Why it's wrong here
Timeout adjustment does not address signature matching issues.
- ✓
Enable packet capture on the security rule to collect traffic for analysis.
Why this is correct
PCAP allows analyzing traffic to see why the wrong signature matched.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.