PCNSE Manage, Monitor and Operate Practice Question
A security team needs to capture traffic for forensic analysis of a specific application that uses non-standard ports. The administrator wants to capture packets on the firewall for that application only, without affecting performance. Which method should be used?
⚠ Common exam trap
Many exam-takers confuse a management-plane tool (tcpdump on the management interface) with a data-plane capture, or they assume port mirroring is the only way to capture traffic, overlooking the firewall's native, performance-friendly PCAP filter feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a PCAP filter in the firewall's packet capture feature
The firewall's built-in packet capture feature with a PCAP filter allows the administrator to capture only traffic matching specific criteria (e.g., application, source/destination IP, port) directly on the data plane, without impacting overall performance. This is the correct method because it isolates the target application's traffic for forensic analysis without requiring external devices or altering traffic flow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a port mirror on the upstream switch
Why it's wrong here
A switch port mirror copies traffic from a switch port, so it captures only what traverses that port and cannot isolate a specific application's flows by port or application signature. It is tempting because mirroring is passive and cheap, but it lacks the firewall's application-aware filtering.
- ✗
Create an application override policy
Why it's wrong here
An application override forces App-ID to classify the traffic on the specified ports, but it does not capture packets; it only changes identification and policy handling. It is tempting because overrides are the correct tool when a custom application must be reliably identified for policy enforcement, not for forensic packet capture.
- ✓
Configure a PCAP filter in the firewall's packet capture feature
Why this is correct
A PCAP filter narrows capture to traffic matching the application's specific ports and addresses, so only relevant packets are recorded. This satisfies the requirement to target the non-standard-port application without the performance overhead of capturing all traffic.
- ✗
Use tcpdump on the management interface
Why it's wrong here
tcpdump on the management interface only sees management-plane traffic, so it cannot capture dataplane flows traversing the firewall's data interfaces. It is tempting because tcpdump is the correct choice for capturing traffic terminating on or originating from the management plane itself.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.