PCNSE Core Concepts and Architecture Practice Question

Exhibit

Refer to the exhibit.

```
admin@PA-3020> show session info

session id 12345, application: ssl, vsys vsys1, zone trust->untrust
source 10.1.1.10:443 -> destination 192.168.1.1:44321
state: active, type: dynamic
session age: 120 sec, timeout: 3600 sec

admin@PA-3020> show system info | match uptime
Uptime: 30 days, 4 hours, 12 minutes
```

An administrator runs the commands and sees the output. The session shows an SSL application from trust to untrust. However, the traffic is actually a custom application over TCP 44321 that the firewall incorrectly identifies as SSL. Which configuration step will most accurately identify the custom application?

⚠ Common exam trap

It's easy for candidates to confuse application override (which forces classification) with custom application definition (which teaches the firewall to correctly identify the traffic), leading them to choose Option B instead of D.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Define a custom application object with the correct protocol signature and protocol type.

The firewall is misidentifying the custom application as SSL due to the use of TCP port 44321, which falls within the default SSL port range. By defining a custom application object with the correct protocol signature (e.g., a protocol decoder or pattern match) and specifying the protocol type (e.g., TCP), the firewall can accurately classify the traffic based on actual payload characteristics rather than relying on port-based heuristics.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disable SSL inspection on the security policy for this traffic.
Why it's wrong here
Disabling inspection may cause the firewall to not identify the application at all.
✗
Create an application override policy for this traffic to mark it as the custom application.
Why it's wrong here
Application override forces the application but does not help the firewall learn the actual protocol; it bypasses App-ID.
✗
Enable SSL decryption on the traffic to inspect the payload.
Why it's wrong here
Decryption only works if the traffic is actually SSL; the custom app is misidentified as SSL.
✓
Define a custom application object with the correct protocol signature and protocol type.
Why this is correct
A custom application object allows the firewall to accurately identify the traffic based on its actual protocol characteristics.

Go deeper

PCNSE Core Concepts and Architecture Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question