PCNSE Securing Traffic and App-ID Practice Question
A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?
⚠ Common exam trap
Candidates often assume App-ID and URL filtering are independent and always work together, but they overlook that URL filtering on encrypted traffic requires SSL decryption to inspect the URL path, a nuance frequently tested in PCNSE questions about decryption policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.
When traffic is encrypted (HTTPS), the firewall cannot inspect the URL path or query parameters unless SSL decryption is enabled. Without decryption, URL filtering relies on the Server Name Indication (SNI) or IP address, which may not distinguish between 'youtube' and 'youtube.com/education' traffic. Since the rule requires both the application 'youtube' and the URL category 'educational-videos', the firewall cannot match the URL category for encrypted YouTube traffic, causing all YouTube traffic to be blocked by the implicit deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule must also specify the source zone.
Why it's wrong here
Zones are likely already defined; missing zones would cause a different error.
- ✗
The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.
Why it's wrong here
Both conditions are ANDed; the application match does not override the URL category.
- ✓
The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.
Why this is correct
Without decryption, the firewall cannot see the URL, so the URL category condition never matches.
- ✗
The URL filtering license is not installed or expired.
Why it's wrong here
If the license were missing, URL filtering would not work at all, but the question implies it is configured.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.