Courseiva
Securing Traffic and App-IDmediumMultiple ChoiceObjective-mapped

PCNSE Securing Traffic and App-ID Practice Question

Exhibit

Refer to the exhibit.
> show app-app-id counter
Application         Packets   Flags
web-browsing        1000
ssl                 500
my-custom-app       0
> show app-override rule
Name: Override-SSH
Source: 10.0.0.0/24
Destination: 10.1.0.0/24
Application: my-custom-app

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

⚠ Common exam trap

It's easy for candidates to assume the issue is with the security policy blocking traffic (Option C) or with the application not being committed (Option D), but the zero-packet counter specifically for the custom app points to a matching failure in the override rule, not a policy or commit problem.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The application override rule does not have the correct port.

An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The traffic is being identified as ssl instead.

    Why it's wrong here

    Counter shows ssl packets, but this could be unrelated traffic. The issue is the missing port in the override rule.

  • The application override rule does not have the correct port.

    Why this is correct

    Correct: Without a port, the override rule does not trigger, and traffic is identified normally.

  • The security policy does not allow the traffic.

    Why it's wrong here

    Security policy is about allowing or denying, but identification happens before that. Even if denied, it would still be counted in the application counter.

  • The custom application my-custom-app is not committed.

    Why it's wrong here

    If not committed, the application would still appear in the configuration, but the counter shows zero. The commit status is not the issue here.

About these practice questions

Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.