PCNSE Manage, Monitor and Operate Practice Question
An organization is migrating from a legacy firewall to a Palo Alto Networks firewall and needs to ensure that all existing application-based policies are accurately replicated. The engineer exports the configuration from the old firewall and imports it using the 'Config Audit' feature. After import, the engineer notices that many security policy rules have the application set to 'any' instead of the specific applications from the old firewall. What is the most likely reason?
⚠ Common exam trap
Test-takers frequently assume the 'Config Audit' feature automatically converts all legacy application definitions to Palo Alto Networks App-IDs, when in fact it only audits configuration differences and requires manual mapping for application-specific policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The administrator did not correctly map the old firewall's application signatures to Palo Alto Networks application IDs during the migration.
The 'Config Audit' feature in Palo Alto Networks firewalls compares rule configurations but does not automatically translate third-party application signatures into Palo Alto Networks App-IDs. The administrator must manually map the old firewall's application definitions to the correct App-IDs during migration; otherwise, the imported rules default to 'any' for the application field, as the system cannot infer the intended application without explicit mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The old firewall did not support application identification, so the import process defaulted to 'any'.
Why it's wrong here
Many legacy firewalls have basic app support, but the issue is mapping, not lack of support.
- ✗
The import process uses a different naming convention for applications, causing a mismatch.
Why it's wrong here
The import process has built-in mappings for common vendors; however, if custom signatures are present, manual mapping is needed.
- ✓
The administrator did not correctly map the old firewall's application signatures to Palo Alto Networks application IDs during the migration.
Why this is correct
Without proper mapping, the import process cannot translate legacy app signatures to PAN-OS app IDs, resulting in 'any'.
- ✗
The 'Config Audit' tool does not import applications; it only identifies rule conflicts.
Why it's wrong here
Config Audit is for comparing configurations; it does not perform import.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.