PCNSE Securing Traffic and App-ID Practice Question
A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?
⚠ Common exam trap
Candidates often think an application override policy ensures correct identification, but in reality it bypasses App-ID entirely, so it does not cause App-ID to fail—it prevents App-ID from running at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL decryption is not enabled for the traffic.
App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is allowed by a security policy rule.
Why it's wrong here
Allowing traffic in a security policy does not affect App-ID's ability to identify the application.
- ✗
An application override policy is configured for the traffic.
Why it's wrong here
An application override explicitly bypasses App-ID, so this would not cause App-ID to fail; it would prevent App-ID from being applied.
- ✓
SSL decryption is not enabled for the traffic.
Why this is correct
Without SSL decryption, App-ID cannot inspect encrypted traffic, leading to incorrect or failed identification.
- ✓
The application is not in the Palo Alto Networks application database.
Why this is correct
If the application is not in the database, App-ID cannot identify it, resulting in unknown traffic.
- ✗
The firewall is using port-based application identification.
Why it's wrong here
Port-based identification is not used by Palo Alto Networks; App-ID uses signatures and behavioral analysis.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.