PCNSE Troubleshoot Practice Question
A new application is not being identified by the firewall. Traffic for the application is being treated as 'unknown-tcp'. Which action should be taken to resolve this?
⚠ Common exam trap
Many candidates choose 'Update the application and threat signatures' (Option B) thinking it's the standard fix, but the question implies the application is new or custom and may never be identified by signatures, making an application override the correct immediate solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an application override for the application.
When a firewall fails to identify an application and treats its traffic as 'unknown-tcp', the most direct and efficient solution is to create an application override. This manually maps the traffic (based on IP/port/protocol) to the correct application, bypassing the firewall's signature-based identification. Option D is correct because it immediately resolves the misclassification without waiting for signature updates or weakening security by broadly allowing unknown traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the security policy rule to allow 'unknown-tcp'.
Why it's wrong here
Allowing unknown-tcp would permit the traffic but still not identify the application.
- ✗
Update the application and threat signatures.
Why it's wrong here
If the application is brand new, it may not be in the signature database yet; updating might help, but the question assumes it's a custom app.
- ✗
Disable application identification on the zone.
Why it's wrong here
Disabling application identification would make all traffic unknown, which is counterproductive.
- ✓
Create an application override for the application.
Why this is correct
An application override allows the firewall to identify traffic based on port and IP criteria, useful for custom applications.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.