PCNSE Securing Traffic and App-ID Practice Question
Exhibit
Refer to the exhibit. > show app-app-id counter Application Packets Flags web-browsing 1000 ssl 500 my-custom-app 0 > show app-override rule Name: Override-SSH Source: 10.0.0.0/24 Destination: 10.1.0.0/24 Application: my-custom-app
An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to assume the issue is with the security policy blocking traffic (Option C) or with the application not being committed (Option D), but the zero-packet counter specifically for the custom app points to a matching failure in the override rule, not a policy or commit problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application override rule does not have the correct port.
An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is being identified as ssl instead.
Why it's wrong here
Counter shows ssl packets, but this could be unrelated traffic. The issue is the missing port in the override rule.
- ✓
The application override rule does not have the correct port.
Why this is correct
Correct: Without a port, the override rule does not trigger, and traffic is identified normally.
- ✗
The security policy does not allow the traffic.
Why it's wrong here
Security policy is about allowing or denying, but identification happens before that. Even if denied, it would still be counted in the application counter.
- ✗
The custom application my-custom-app is not committed.
Why it's wrong here
If not committed, the application would still appear in the configuration, but the counter shows zero. The commit status is not the issue here.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.