PCNSE Securing Traffic and App-ID Practice Question
An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?
⚠ Common exam trap
Test-takers frequently assume a rule allowing an application by name will automatically match traffic on standard ports, forgetting that App-ID must first correctly identify the application for the rule to apply.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.
App-ID is the core mechanism that identifies applications by inspecting traffic beyond port numbers. If the firewall misidentifies the traffic (e.g., as 'ssl' or 'web-browsing' instead of 'ms-update'), the security rule specifically allowing 'ms-update' will not match, and the traffic will be denied by the implicit deny rule. Therefore, verifying App-ID identification is the first logical step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confirm that the source and destination users are correctly configured.
Why it's wrong here
User-ID is not required for application-based rules.
- ✗
Ensure that a security profile is applied to the rule to allow the application.
Why it's wrong here
Security profiles do not affect whether a rule allows traffic.
- ✗
Check if the rule is placed after a deny-all rule.
Why it's wrong here
Rule order is important but the rule should be placed appropriately.
- ✓
Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.
Why this is correct
If the traffic is not identified as 'ms-update', the rule will not match.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.