PCNSE Securing Traffic and App-ID Practice Question
Exhibit
Refer to the exhibit. > show app-app-id counter Application Packets Flags web-browsing 1000 ssl 500 my-custom-app 0 > show app-override rule Name: Override-SSH Source: 10.0.0.0/24 Destination: 10.1.0.0/24 Application: my-custom-app
An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to assume the issue is with the security policy blocking traffic (Option C) or with the application not being committed (Option D), but the zero-packet counter specifically for the custom app points to a matching failure in the override rule, not a policy or commit problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application override rule does not have the correct port.
An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is being identified as ssl instead.
Why it's wrong here
SSL identification occurs when the firewall cannot match a custom application and falls back to the parent App-ID, so traffic would still increment a counter, just not the custom one. It is tempting because App-ID fallback is real, but the stem's zero-packet custom counter points to the application not being committed.
- ✓
The application override rule does not have the correct port.
Why this is correct
Application override rules match on the port defined in the override, not the signature's default. If the configured port differs from the actual destination port carrying the traffic, the override never triggers, so the custom app counter stays at zero despite matching source and destination subnets.
- ✗
The security policy does not allow the traffic.
Why it's wrong here
A security policy denying the traffic would produce zero packets in the application counter, but the question asks why the custom application shows no matches rather than why traffic is blocked. It is tempting because policy denial is a common cause of missing traffic, yet the counter reflects identification, not permit or deny.
- ✗
The custom application my-custom-app is not committed.
Why it's wrong here
Uncommitted configuration means the custom application definition never reaches the dataplane, so no packets match its signature. It is tempting because commit is a routine step, and it would be the answer if the app were committed but the session used a different destination port than the defined pattern.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.