PCNSE Securing Traffic and App-ID Practice Question
A security administrator needs to block an application that uses multiple ports, including dynamic ports. Which of the following methods can be used to block this application using App-ID? (Choose two.)
⚠ Common exam trap
Test-takers frequently assume port-based blocking (Option E) is sufficient for applications using dynamic ports, but App-ID's port-agnostic identification is the correct approach, and they may also confuse application override (Option A) as a blocking mechanism rather than a classification tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a security rule with the application set to the malicious application and action Deny.
App-ID identifies applications regardless of port, so a security rule with the application set to the malicious application and action Deny will block that application even when it uses dynamic ports. This leverages App-ID's ability to classify traffic based on application signatures, not just port numbers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an application override to force identification of the application on all ports.
Why it's wrong here
This helps identification but does not block the traffic on its own.
- ✓
Create a security rule with the application set to the malicious application and action Deny.
Why this is correct
Correct: Denying by application blocks the traffic regardless of port.
- ✗
Use decryption to inspect the application content.
Why it's wrong here
Decryption aids inspection but does not block traffic by itself.
- ✓
Create a custom application with multiple default ports.
Why this is correct
Correct: Defining multiple default ports helps the firewall identify the application on those ports, which can then be denied.
- ✗
Create a security rule with the destination port range that covers all possible ports.
Why it's wrong here
This is impractical for dynamic ports and does not leverage App-ID.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.