PCNSE Securing Traffic and App-ID Practice Question
A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?
⚠ Common exam trap
Watch out — candidates often think creating a custom application with a signature is sufficient for identification, but they overlook the need for an application override to bypass the default App-ID classification for traffic on standard ports like 80 or 443.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application override is not configured.
When a custom application is created with a signature, the firewall uses App-ID to identify the traffic based on the signature. However, if the traffic is still being misidentified as 'web-browsing', it means the firewall is matching the default HTTP/HTTPS application before the custom signature can be evaluated. An application override is required to explicitly tell the firewall to skip App-ID processing for that traffic and instead use the custom application 'my-app'. Without the override, the firewall's default App-ID logic continues to classify the traffic based on its standard signatures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The custom application is not activated in the security policy rule.
Why it's wrong here
Security policy rules use the identified application; they do not affect the identification process itself.
- ✓
The application override is not configured.
Why this is correct
Correct: Application override forces the firewall to identify traffic using the custom application's signature, overriding the default identification.
- ✗
The vulnerability protection profile is dropping the traffic.
Why it's wrong here
Vulnerability protection profiles inspect traffic after identification and would not cause misidentification.
- ✗
The decryption policy is blocking the traffic.
Why it's wrong here
Decryption policy affects whether traffic is decrypted, not the initial identification via App-ID.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.