Courseiva

CCNA Securing Traffic and App-ID Questions

61 questions · Securing Traffic and App-ID · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

After upgrading PAN-OS from version 9.1 to 10.0, an administrator notices that traffic for an internal custom application is now classified as unknown-tcp instead of the expected custom application. The application was defined using a custom App-ID in the previous version. What is the most likely cause?

A.The new version deprecated the application signature.
B.The custom App-ID is incompatible with the new version and needs to be re-created.
C.The firewall license expired after the upgrade.
D.The upgrade reset the firewall configuration.
AnswerB

Upgrades can change App-ID engine behavior; custom applications may require redefinition.

Why this answer

When upgrading PAN-OS from version 9.1 to 10.0, custom App-IDs defined in the previous version are not automatically compatible because the internal App-ID framework and signature format changed significantly between these major versions. The custom application definition must be re-created or re-imported using the new version's tools, as the old custom App-ID object becomes orphaned or non-functional, causing traffic to fall back to unknown-tcp.

Exam trap

The trap here is that candidates assume custom App-IDs are backward-compatible across major PAN-OS upgrades, when in reality they often require manual re-creation due to changes in the internal App-ID engine and signature format.

How to eliminate wrong answers

Option A is wrong because PAN-OS does not deprecate custom application signatures during an upgrade; deprecation applies only to built-in applications, not user-defined ones. Option C is wrong because an expired license would affect threat prevention, URL filtering, or global protect features, but not the classification of custom App-IDs; App-ID functionality is part of the base firewall license. Option D is wrong because a PAN-OS upgrade does not reset the firewall configuration; configuration is preserved across upgrades unless a factory reset is explicitly performed.

Practice this question →
2
MCQeasy

A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?

A.The custom application is not activated in the security policy rule.
B.The application override is not configured.
C.The vulnerability protection profile is dropping the traffic.
D.The decryption policy is blocking the traffic.
AnswerB

Correct: Application override forces the firewall to identify traffic using the custom application's signature, overriding the default identification.

Why this answer

When a custom application is created with a signature, the firewall uses App-ID to identify the traffic based on the signature. However, if the traffic is still being misidentified as 'web-browsing', it means the firewall is matching the default HTTP/HTTPS application before the custom signature can be evaluated. An application override is required to explicitly tell the firewall to skip App-ID processing for that traffic and instead use the custom application 'my-app'.

Without the override, the firewall's default App-ID logic continues to classify the traffic based on its standard signatures.

Exam trap

The trap here is that candidates often think creating a custom application with a signature is sufficient for identification, but they overlook the need for an application override to bypass the default App-ID classification for traffic on standard ports like 80 or 443.

How to eliminate wrong answers

Option A is wrong because the custom application does not need to be 'activated' in a security policy rule; it is automatically available once created and committed, and the issue is about identification, not policy enforcement. Option C is wrong because a vulnerability protection profile drops traffic based on threats, not misidentification; it would not cause the traffic to be seen as 'web-browsing' instead of 'my-app'. Option D is wrong because the decryption policy controls whether traffic is decrypted or not, but it does not affect how App-ID classifies the application; misidentification occurs before decryption decisions are applied.

Practice this question →
3
MCQhard

Refer to the exhibit. An administrator notices that HTTPS traffic to a specific website is being denied. What is the most likely cause?

A.The HTTPS traffic is being identified as web-browsing instead of ssl, so it does not match rule 2 and is denied by rule 3.
B.Rule 2 does not have a service set to application-default, so it cannot match the traffic.
C.The traffic is from trust to trust, matching rule 4, but still denied.
D.The traffic requires a specific service other than application-default.
AnswerA

If App-ID misidentifies HTTPS traffic as web-browsing, it fails to match rule 2 and is blocked.

Why this answer

When App-ID identifies HTTPS traffic as web-browsing (HTTP over port 443) instead of ssl, the traffic does not match rule 2 (which requires the 'ssl' application). Consequently, it falls through to rule 3, which denies the traffic. This misidentification often occurs when the SSL handshake is incomplete or when decryption is not configured, causing the firewall to classify the traffic based on the port rather than the application signature.

Exam trap

A common trap is to assume that the service setting (application-default) is required for App-ID to match traffic, when the real issue is application misidentification due to incomplete SSL inspection or port-based fallback.

How to eliminate wrong answers

Option B is wrong because rule 2 does not need a service set to application-default; the service setting is used for port-based matching, but App-ID can match applications regardless of the service if the application is correctly identified. Option C is wrong because the traffic is from trust to untrust (as indicated by the exhibit showing source zone trust and destination zone untrust), not trust to trust, so rule 4 does not apply. Option D is wrong because the issue is not about requiring a specific service; the traffic is being denied because App-ID misclassifies it as web-browsing, not because of a missing service definition.

Practice this question →
4
MCQhard

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

A.An application override policy is being used extensively.
B.Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.
C.SSL decryption is disabled for most traffic.
D.The application database is outdated and missing signatures.
AnswerB

Poorly designed security policies can cause unnecessary traffic to be inspected, leading to a high number of pending sessions.

Why this answer

When security policy rules are not optimized, excessive traffic may be processed by App-ID, causing a backlog of sessions waiting for application identification. The firewall's dataplane can become overwhelmed if too many sessions require deep packet inspection before a decision is made, leading to high CPU utilization and a large number of pending App-ID sessions.

Exam trap

The trap here is that candidates often assume a high number of pending App-ID sessions is caused by a lack of signatures or decryption, when in fact it is typically a symptom of rulebase inefficiency that forces excessive traffic through the App-ID engine.

How to eliminate wrong answers

Option A is wrong because an application override policy bypasses App-ID entirely, which would reduce pending sessions, not increase them. Option C is wrong because disabling SSL decryption actually reduces the processing burden on App-ID, as encrypted traffic cannot be fully inspected for application identification, so it would not cause a high number of pending sessions. Option D is wrong because an outdated application database might cause misidentification or missed signatures, but it would not directly cause a high number of sessions to remain pending; pending sessions are typically due to processing backlogs, not missing signatures.

Practice this question →
5
MCQmedium

During an audit, it is discovered that some traffic from a legacy application is being incorrectly identified as 'ssl' because the application uses a custom encryption scheme over TCP port 443. The engineer has created a custom application signature that matches the legacy application's handshake. What additional configuration is needed to ensure the legacy application is correctly identified?

A.Create an application override rule to force the identification.
B.Create a security policy rule that explicitly allows the custom application.
C.Change the default port of the custom application from 443 to a different port.
D.Disable SSL decryption for that traffic.
AnswerA

Correct: Application override ensures the custom signature is used, overriding the default identification.

Why this answer

An application override rule forces App-ID to classify traffic based on the custom signature, bypassing the default identification that incorrectly flags the legacy application's custom encryption over TCP 443 as 'ssl'. Without the override, App-ID may still match the traffic to the built-in 'ssl' application due to port-based heuristics, even with a custom signature defined. The override ensures the custom application is applied to the session, overriding any conflicting App-ID results.

Exam trap

The trap here is that candidates assume creating a custom signature alone is sufficient to reclassify traffic, but they overlook that App-ID's port-based heuristics for well-known ports like 443 can override signature matches unless an explicit application override is configured.

How to eliminate wrong answers

Option B is wrong because creating a security policy rule that explicitly allows the custom application does not change how App-ID identifies the traffic; the traffic would still be misidentified as 'ssl' and might be blocked or logged incorrectly. Option C is wrong because changing the default port of the custom application from 443 to a different port does not address the misidentification; the legacy application still uses TCP 443, and App-ID would continue to see the traffic on that port, potentially matching 'ssl' again. Option D is wrong because disabling SSL decryption does not affect App-ID identification; decryption is a separate function that inspects encrypted payloads, but the custom encryption scheme is not SSL/TLS, so decryption would fail or be irrelevant, and the traffic would still be misidentified as 'ssl'.

Practice this question →
6
Multi-Selecthard

Which THREE attributes can be used in a custom App-ID signature to identify an application? (Choose three.)

Select 3 answers
A.Protocol (TCP, UDP, etc.)
B.Port number
C.Data pattern (regular expression or byte sequence)
D.URL category
E.Security policy action
AnswersA, B, C

Protocol is a mandatory field in custom signatures.

Why this answer

A is correct because the protocol (TCP, UDP, etc.) is a fundamental attribute used in custom App-ID signatures to define the transport layer over which the application traffic flows. The firewall uses this to match the signature against the correct protocol type, ensuring accurate application identification.

Exam trap

A common misconception is that URL category or security policy action are part of App-ID signature attributes, but they are separate features (URL Filtering and Policy Enforcement) that operate after App-ID identification is complete.

Practice this question →
7
Multi-Selectmedium

A security administrator is configuring App-ID to identify custom applications over TCP port 8080. The traffic is HTTP-based but the firewall is classifying it as 'web-browsing'. Which two steps should the administrator take to ensure the traffic is correctly identified as the custom application? (Choose two.)

Select 2 answers
A.Create an application override for the custom application.
B.Enable SSL decryption on the traffic.
C.Set the application to 'any' in the security policy.
D.Configure a security policy rule to allow the application.
E.Create a custom App-ID signature for the application.
AnswersA, E

An application override forces the firewall to classify the traffic as the specified application, ensuring correct identification.

Why this answer

An application override forces the firewall to bypass App-ID inspection and classify traffic based on the specified application (the custom application) and port (8080). This is necessary when the firewall's default App-ID engine misidentifies HTTP-based traffic as 'web-browsing' instead of the custom application. Overrides are applied in the security policy rule and take precedence over signature-based identification.

Exam trap

The trap here is that candidates often confuse application overrides with security policy rules, thinking that simply allowing the application in a policy will reclassify the traffic, when in fact the firewall must first identify the application correctly before the policy can match it.

Practice this question →
8
MCQmedium

An administrator wants to apply different security policies for different applications that may use the same IP addresses and ports. Which firewall configuration feature should be used?

A.Application Override
B.Quality of Service (QoS) policy
C.Security policy with App-ID
D.Decryption policy
AnswerC

Security rules can match on application identity, allowing per-application policies.

Why this answer

App-ID is the correct feature because it enables the firewall to identify and enforce security policies based on the application, regardless of the IP address or port used. This allows different security policies for different applications even when they share the same IP and port, such as HTTP and FTP both using TCP/80.

Exam trap

The trap here is that candidates may confuse Application Override with App-ID, thinking that manually overriding application classification is the solution, when in fact App-ID automatically identifies applications and allows policy differentiation without manual intervention.

How to eliminate wrong answers

Option A is wrong because Application Override is used to manually classify traffic when App-ID cannot identify it, but it does not enable different policies for different applications on the same IP/port—it simply forces a specific application label. Option B is wrong because Quality of Service (QoS) policy manages bandwidth allocation and prioritization, not security policy differentiation based on application identity. Option D is wrong because Decryption policy controls whether traffic is decrypted for inspection, but it does not directly apply different security policies for different applications using the same IP/port.

Practice this question →
9
MCQeasy

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

A.Create a new application and define the default port.
B.Create a new application group.
C.Create a new custom application tag.
D.Create a new application filter.
AnswerA

Correct: Creating the application object with its default port is the foundational step.

Why this answer

To create a custom application for a proprietary database protocol using TCP port 7890, the first step is to create a new application and define the default port. In App-ID, custom applications are defined by specifying the application name, the protocol (TCP/UDP), and the default port number, which allows the firewall to identify traffic for that application based on the port. This is the foundational step before any additional properties like timeouts or advanced settings can be configured.

Exam trap

The trap here is that candidates often confuse the order of operations and think they need to first create an application group or tag to organize the custom application, but the actual first step is always to create the application object itself with its default port.

How to eliminate wrong answers

Option B is wrong because an application group is used to logically group multiple applications for policy enforcement, not to define a new application or its port. Option C is wrong because a custom application tag is a label for organizing applications, not a method to define the application itself or its port. Option D is wrong because an application filter is used to select applications based on predefined criteria (e.g., category, technology), not to create a new application with a specific port.

Practice this question →
10
MCQhard

Refer to the exhibit. A user at 10.1.1.100 reports that they cannot access a website at 10.2.2.200 over HTTPS. The firewall shows the session is allowed with application web-browsing, but the security policy rule "Allow-Web" has application set to ssl. What is the most likely cause?

A.The application override is configured incorrectly.
B.The security policy rule order is incorrect.
C.The SSL decryption policy is not configured.
D.The service is set to application-default.
AnswerC

Without decryption, App-ID sees only the SSL handshake and identifies the traffic as web-browsing on port 443, not as the more specific ssl application.

Why this answer

The session is allowed with application web-browsing, but the security policy rule 'Allow-Web' has application set to ssl. This indicates that the firewall is not decrypting the HTTPS traffic, so App-ID sees only the encrypted TCP handshake and incorrectly identifies it as web-browsing (HTTP) rather than ssl (HTTPS). Without an SSL decryption policy to decrypt the traffic, App-ID cannot inspect the encrypted payload to correctly identify the application as ssl, causing a mismatch between the policy rule's application requirement and the session's identified application.

Exam trap

Palo Alto Networks often tests the misconception that a security policy rule with application set to ssl will automatically match HTTPS traffic, but without SSL decryption, App-ID cannot identify the application as ssl, causing the rule to not apply.

How to eliminate wrong answers

Option A is wrong because an application override would force the application to a specific value regardless of App-ID, but the session shows web-browsing, not ssl, indicating no override is in effect. Option B is wrong because the security policy rule order is irrelevant when the session is allowed by the rule 'Allow-Web' — the issue is that the rule's application condition (ssl) is not met, not that a different rule is matching first. Option D is wrong because the service set to application-default is not the cause; the service (TCP/443) is correctly matched, but the application identification (web-browsing vs. ssl) is the problem, and application-default does not affect App-ID's ability to identify the application.

Practice this question →
11
MCQeasy

An engineer wants to block all peer-to-peer file sharing traffic using App-ID. What security policy action should be used?

A.Drop.
B.Reset-both.
C.Allow with antivirus profile.
D.Deny.
AnswerD

Correct: Deny blocks the traffic and sends a TCP reset.

Why this answer

The standard action to block traffic in a security policy rule is 'deny'. 'Drop' also blocks but does not send a TCP reset, while 'deny' sends a reset. 'Allow' would permit the traffic, and 'reset-both' is a type of deny, but 'deny' is the typical best practice.

Practice this question →
12
MCQhard

A firewall in a high-availability pair shows that App-ID signatures are not syncing between units. Sessions are failing over but application identification is incorrect on the passive unit. What should the administrator verify?

A.Ensure both units have the same App-ID license installed.
B.Configure session distribution for symmetric return.
C.Verify that application override policies are replicated via HA configuration sync.
D.Check that sessions are established on both units.
AnswerA

Correct. The App-ID license is required to receive App-ID signatures. If the passive unit lacks this license, it won't have the same signatures as the active unit, leading to incorrect App-ID after failover.

Why this answer

App-ID signatures are part of the content (App-ID and threat) updates, which require the App-ID license. If both units do not have the same App-ID license installed, the passive unit may lack the necessary signatures, causing incorrect application identification after failover. Verifying that both units have the same license ensures they are eligible to receive the same content updates.

Exam trap

Candidates often confuse application override policies (configuration) with App-ID signature updates (content). The question specifically states 'App-ID signatures are not syncing,' which points to content synchronization and licensing, not configuration replication.

How to eliminate wrong answers

Option A is wrong because App-ID signatures are not tied to a separate license; they are included in the Threat Prevention subscription or the base URL filtering license, and both units must have the same set of content updates (e.g., via dynamic updates), not a specific App-ID license. Option B is wrong because session distribution for symmetric return is a feature for active/active HA or asymmetric routing, not related to App-ID signature sync between HA units. Option D is wrong because sessions failing over correctly indicates that session establishment is working; the issue is specifically with App-ID signature synchronization, not session state.

Practice this question →
13
Multi-Selecthard

An administrator is troubleshooting low throughput for a business-critical application that is identified as web-browsing instead of the custom app. The firewall is in inline mode. Which THREE potential causes should be investigated?

Select 3 answers
A.SSL decryption is not enabled.
B.The application signature is outdated.
C.The custom application uses a non-standard port.
D.Application Override policy is incorrectly configured.
E.The firewall is in tap mode.
AnswersB, C, D

An outdated signature may not recognize the custom application.

Why this answer

If the application signature is outdated, the firewall may fail to identify the custom application correctly, instead classifying it as web-browsing. App-ID relies on regularly updated signatures to match application traffic; an outdated signature can cause misidentification, leading to incorrect policy application and reduced throughput for the intended application.

Exam trap

The trap here is that candidates may assume SSL decryption is always needed for application identification, but App-ID can identify many applications without decryption using techniques like TLS fingerprinting and SNI inspection.

Practice this question →
14
MCQhard

A threat log entry shows a threat detected in SSL traffic to 10.0.0.5, which is a server in the internal network. However, the decryption policy has a rule to no-decrypt traffic to 10.0.0.0/8 from internal sources. What is the most likely reason the threat was detected?

A.The decryption policy rule order is incorrect; the 'No-Decrypt-Internal' rule should be after the 'Decrypt-All' rule.
B.The threat was detected in decrypted traffic because the source was external.
C.The threat log is misconfigured.
D.The security policy is blocking the traffic before decryption.
AnswerB

Correct: The source is likely external, so the traffic is decrypted by rule 2, and the threat profile detected it.

Why this answer

The threat was detected because the decryption policy rule 'No-Decrypt-Internal' only applies to traffic where both the source and destination are internal (10.0.0.0/8). If the source is external, the traffic is decrypted by a higher-priority rule (e.g., 'Decrypt-All'), allowing the threat to be inspected and logged. The log entry shows the threat in SSL traffic to 10.0.0.5, but the source being external means the no-decrypt rule does not match, so decryption occurs.

Exam trap

The trap here is that candidates assume 'No-Decrypt-Internal' applies to all traffic to internal IPs regardless of source, but the rule's source zone or IP must also be internal for it to match; external sources cause decryption to occur.

How to eliminate wrong answers

Option A is wrong because the order of decryption rules is evaluated top-down; a 'No-Decrypt-Internal' rule should be placed before a 'Decrypt-All' rule to ensure internal traffic is excluded from decryption, not after. Option C is wrong because the threat log is not misconfigured; it correctly reflects the detection in decrypted traffic when the source is external. Option D is wrong because the security policy does not block traffic before decryption; decryption occurs before security policy evaluation, and a threat detected in decrypted traffic indicates decryption happened successfully.

Practice this question →
15
MCQeasy

A firewall shows session logs with application 'incomplete' for many SSL connections. Which action should be taken to improve App-ID accuracy?

A.Disable application identification for SSL traffic.
B.Enable HTTP/2 protocol decoding.
C.Enable SSL decryption for the traffic.
D.Allow sessions with application 'incomplete' in policy.
AnswerC

Decryption reveals the underlying application.

Why this answer

The 'incomplete' application label indicates that the firewall could not fully identify the application because the traffic was encrypted. Enabling SSL decryption allows the firewall to inspect the decrypted payload, which is necessary for App-ID to accurately classify the application. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is often insufficient for SSL connections.

Exam trap

The trap here is that candidates may think enabling HTTP/2 decoding (Option B) will solve the issue, but HTTP/2 is a transport protocol, not a decryption mechanism; without SSL decryption, the firewall still cannot see the encrypted payload regardless of the HTTP version.

How to eliminate wrong answers

Option A is wrong because disabling application identification for SSL traffic would prevent any App-ID analysis, leaving all SSL sessions as 'incomplete' and defeating the purpose of improving accuracy. Option B is wrong because HTTP/2 protocol decoding is a feature for parsing HTTP/2 traffic, but it does not address the root cause of encryption; without decryption, the firewall still cannot inspect the payload to identify the application. Option D is wrong because allowing sessions with application 'incomplete' in policy does not improve App-ID accuracy; it merely bypasses security controls, leaving the traffic unidentified and potentially risky.

Practice this question →
16
MCQmedium

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

A.Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.
B.Enable unknown application identification in the security rule.
C.Use the default application override for port 4444 to allow traffic.
D.Change the security rule to use 'application-default' as the service to rely on port-based identification.
AnswerA

Custom App-IDs allow identification of proprietary protocols by defining signatures.

Why this answer

App-ID relies on application signatures to identify traffic, not just port numbers. Since custom-db-sync uses a proprietary protocol over TCP 4444, the firewall cannot match it to any built-in App-ID. Creating a custom App-ID with appropriate signatures (e.g., protocol decoders, pattern matches) allows the firewall to correctly identify this custom application, enabling policy enforcement beyond port-based rules.

Exam trap

The trap here is that candidates often confuse 'application override' (which bypasses App-ID) with 'custom App-ID' (which enhances App-ID), leading them to choose option C, thinking it will force identification when it actually disables App-ID for that traffic.

How to eliminate wrong answers

Option B is wrong because enabling unknown application identification only allows the firewall to treat unidentified traffic as 'unknown-tcp' or 'unknown-udp', but it does not create a specific signature to identify custom-db-sync; the traffic would still not be recognized as that custom application. Option C is wrong because an application override bypasses App-ID entirely, forcing the firewall to treat all traffic on port 4444 as a specified application, which defeats the purpose of using App-ID to correctly identify the custom protocol. Option D is wrong because using 'application-default' as the service only changes the port binding to the default port for the identified application, but since custom-db-sync is not identified at all, this action does not enable its recognition; App-ID must first identify the application before 'application-default' can be relevant.

Practice this question →
17
MCQmedium

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

A.Confirm that the source and destination users are correctly configured.
B.Ensure that a security profile is applied to the rule to allow the application.
C.Check if the rule is placed after a deny-all rule.
D.Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.
AnswerD

If the traffic is not identified as 'ms-update', the rule will not match.

Why this answer

App-ID is the core mechanism that identifies applications by inspecting traffic beyond port numbers. If the firewall misidentifies the traffic (e.g., as 'ssl' or 'web-browsing' instead of 'ms-update'), the security rule specifically allowing 'ms-update' will not match, and the traffic will be denied by the implicit deny rule. Therefore, verifying App-ID identification is the first logical step.

Exam trap

The trap here is that candidates assume a rule allowing an application by name will automatically match traffic on standard ports, forgetting that App-ID must first correctly identify the application for the rule to apply.

How to eliminate wrong answers

Option A is wrong because source and destination users are irrelevant when the rule is based on application identification, not user identity; user configuration would only matter if the rule had a User-ID condition. Option B is wrong because security profiles (e.g., antivirus, vulnerability protection) are applied after the rule matches and do not affect whether the rule permits or denies traffic; they only inspect allowed traffic. Option C is wrong because a deny-all rule at the end of the policy list would block all unmatched traffic, but the question states a rule allowing 'ms-update' exists; the issue is that the rule is not matching, not that it is placed incorrectly relative to a deny-all rule.

Practice this question →
18
Multi-Selectmedium

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

Select 2 answers
A.Disable App-ID on port 8443.
B.Use an application override with port 8443.
C.Add a custom URL category for the domain.
D.Create a custom application with a hostname condition.
E.Enable SSL forward proxy and import the internal CA certificate.
AnswersD, E

Hostname condition matches the SNI to identify the application.

Why this answer

A custom application can be defined with a hostname condition to match traffic based on the SNI field in the TLS handshake, which allows App-ID to identify the application even when it uses a non-standard port like 8443. Option E is correct because enabling SSL forward proxy with the internal CA certificate allows the firewall to decrypt the SSL/TLS traffic and inspect the application payload, which is necessary for App-ID to accurately identify the custom application.

Exam trap

The trap here is that candidates often confuse application override with custom application creation, thinking that an override helps identify the application, when in fact it bypasses App-ID entirely and only assigns a static label.

Practice this question →
19
MCQeasy

When configuring a custom application signature, which field is mandatory to define the application?

A.Category
B.Protocol
C.Port
D.Subcategory
AnswerB

Protocol is required for the firewall to know which signatures to apply.

Why this answer

In Palo Alto Networks App-ID, when creating a custom application signature, the Protocol field is mandatory because App-ID uses protocol detection as the first step to identify traffic. Without specifying the protocol (e.g., TCP, UDP, or a specific protocol number), the firewall cannot associate the signature with the correct traffic stream, making the application definition incomplete.

Exam trap

The trap here is that candidates often assume Port is mandatory because of traditional firewall rules, but Palo Alto Networks App-ID is designed to identify applications regardless of port, making Protocol the only mandatory field for custom signatures.

How to eliminate wrong answers

Option A is wrong because Category is an optional classification field used for reporting and policy organization, not for defining the application's identity. Option C is wrong because Port is not mandatory; App-ID is port-agnostic and can identify applications on any port, so specifying a port is optional and only used for narrowing detection. Option D is wrong because Subcategory is also an optional classification field that further refines the application's grouping, but it is not required for the signature to function.

Practice this question →
20
MCQmedium

A company uses a custom application for internal VoIP traffic. The custom App-ID signature is configured with the correct protocol and port, but traffic is still not matching. The firewall shows the application as 'unknown-tcp'. What should the administrator check next?

A.Verify that the port range in the custom application is correct.
B.Update the App-ID signature database.
C.Check for asymmetric routing on the firewall.
D.Ensure a protocol decoder (e.g., SIP) is enabled for the application.
AnswerD

VoIP often uses dynamic ports; a protocol decoder is needed for full identification.

Why this answer

Custom App-ID signatures require a protocol decoder to inspect application-layer payloads. Even if the port and protocol are correctly defined, without an enabled decoder (e.g., SIP for VoIP), the firewall cannot identify the application and falls back to 'unknown-tcp'. Enabling the appropriate decoder allows the firewall to parse the traffic and match the custom signature.

Exam trap

The trap here is that candidates assume a custom App-ID only needs correct port/protocol definitions, overlooking that protocol decoders are mandatory for application-layer identification of VoIP and other complex protocols.

How to eliminate wrong answers

Option A is wrong because the question states the port and protocol are already correct; verifying the port range again would not resolve the issue since the traffic is already reaching the firewall as 'unknown-tcp'. Option B is wrong because updating the App-ID signature database applies to built-in signatures, not custom ones; custom signatures are defined locally and do not rely on database updates. Option C is wrong because asymmetric routing would cause session setup failures or traffic drops, not a consistent classification of traffic as 'unknown-tcp' when the session is established.

Practice this question →
21
MCQmedium

Refer to the exhibit. A network engineer wants to allow only 'ms-update' and 'facebook-base' traffic. After committing the above security policy, they find that 'ssl' traffic is also being allowed. What is the most likely reason?

A.Rule 1 allows all applications because it uses 'application any'.
B.App-ID is not enabled on the firewall.
C.Rule 4 is a deny rule but it is not effective because the traffic is allowed earlier.
D.The rule order is incorrect; rule 3 should be moved before rule 1.
AnswerA

Rule 1 matches all applications before the more specific rules, causing all traffic to be allowed.

Why this answer

Rule 1 uses 'application any', which matches all applications regardless of the specific App-ID. Since security policies are evaluated from top to bottom and the first matching rule is applied, any traffic that matches Rule 1's source, destination, and service will be allowed, including 'ssl' traffic. The explicit allow rules for 'ms-update' and 'facebook-base' are irrelevant because Rule 1 catches all traffic first.

Exam trap

Palo Alto Networks often tests the misconception that adding a deny rule later in the policy will block traffic that was already allowed by an earlier rule, but the trap here is that rule order is evaluated top-down and the first match wins, so a broad allow rule with 'application any' will permit all traffic before any deny or specific allow rules are reached.

How to eliminate wrong answers

Option B is wrong because if App-ID were not enabled, the firewall would not be able to identify any applications, and traffic would be handled by the default interzone rule (typically deny), not by allowing 'ssl' traffic. Option C is wrong because Rule 4 being a deny rule is irrelevant; the issue is that traffic is matched and allowed by an earlier rule (Rule 1) before reaching any deny rule. Option D is wrong because moving Rule 3 before Rule 1 would not fix the problem; Rule 1 would still match all traffic first, and Rule 3 would never be evaluated for traffic that matches Rule 1.

Practice this question →
22
Drag & Dropmedium

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence for upgrading PAN-OS on a standalone firewall is: Download the new image from the support portal, Upload it to the firewall, Install the image, Reboot the firewall to load the new version, and Verify the upgrade was successful. Common mistakes include swapping the order of upload and download, installing before upload, or reboot before install.

Practice this question →
23
Multi-Selecthard

A network engineer is troubleshooting an issue where a web application is being incorrectly identified as 'web-browsing' instead of 'webmail-gmail' by the Palo Alto Networks firewall. The firewall has App-ID enabled and all signatures are up to date. Which TWO actions should the engineer take to resolve this misidentification?

Select 2 answers
A.Disable unknown application identification to force stricter matching.
B.Create a custom App-ID for webmail-gmail with stricter signatures.
C.Review the session log to see if the application changed during the session.
D.Increase the application identification timeout to allow more time for identification.
E.Enable packet capture on the security rule to collect traffic for analysis.
AnswersC, E

Session logs show App-ID updates; the application may have been re-identified later.

Why this answer

App-ID can reclassify a session as more data becomes available. A session that starts as 'web-browsing' may later be identified as 'webmail-gmail' once the firewall sees application-specific traffic (e.g., SMTP, IMAP, or proprietary Gmail API calls). Reviewing the session log to see if the application changed during the session helps confirm whether the firewall eventually identified the correct application.

Exam trap

The trap here is that candidates assume a static, one-time identification and overlook the fact that App-ID can dynamically reclassify a session as more data is analyzed, making the session log a critical diagnostic tool.

Practice this question →
24
MCQhard

An organization has two different applications (AppA and AppB) that both use TCP port 8080. The firewall must apply different security policies to each application. What is the recommended approach?

A.Use source/destination IP addresses in security policies instead of App-ID.
B.Add the applications on separate virtual wire interfaces.
C.Change the port of one application to a different value.
D.Create an application override policy to identify each application by IP address.
AnswerD

Application override matches based on user-defined criteria, allowing separate policies.

Why this answer

When two applications share the same TCP port (8080), App-ID cannot differentiate them based on port alone. An application override policy allows you to explicitly identify each application by its source/destination IP address, overriding the default App-ID classification and enabling separate security policies for AppA and AppB.

Exam trap

The trap here is that candidates often assume App-ID can always distinguish applications on the same port, but in reality, when applications share the same port and protocol, an application override is required to enforce different policies based on IP addresses.

How to eliminate wrong answers

Option A is wrong because using source/destination IP addresses in security policies without App-ID bypasses the application visibility and control that App-ID provides, and it does not leverage the firewall's ability to identify applications by their behavior. Option B is wrong because virtual wire interfaces are used for transparent mode deployments and do not solve the problem of distinguishing two applications on the same port; they would still see the same TCP port 8080 traffic. Option C is wrong because changing the port of one application is a workaround that may not be feasible in production and does not utilize the firewall's App-ID capabilities; it also introduces unnecessary complexity and potential compatibility issues.

Practice this question →
25
MCQmedium

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

A.App-ID can only handle 1024 KB of packet data per session.
B.The firewall can buffer up to 1024 KB of packet data for App-ID analysis.
C.The firewall logs the first 1024 KB of every session for App-ID.
D.The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.
AnswerB

This buffer stores packets for deep inspection when needed.

Why this answer

The 'appid packet buffer: 1024 KB' indicates the maximum amount of packet payload data the firewall can buffer per session for App-ID analysis. This buffer stores the initial packets of a session so that App-ID can inspect the payload for application signatures, even if the data arrives in multiple packets. Option B correctly states this buffering capability.

Exam trap

The trap here is confusing the buffer size with a per-session data limit or a logging threshold, when in fact it is a temporary storage mechanism for App-ID analysis.

How to eliminate wrong answers

Option A is wrong because App-ID does not have a hard limit of 1024 KB of packet data per session; the buffer size is a configurable limit for buffering, not a processing limit. Option C is wrong because the firewall does not log the first 1024 KB of every session; it buffers the data for analysis, not for logging purposes. Option D is wrong because App-ID processing is not offloaded to a dedicated buffer; the buffer is part of the firewall's normal packet processing pipeline and is used for temporary storage during signature matching.

Practice this question →
26
Multi-Selectmedium

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Select 2 answers
A.The traffic is allowed by a security policy rule.
B.An application override policy is configured for the traffic.
C.SSL decryption is not enabled for the traffic.
D.The application is not in the Palo Alto Networks application database.
E.The firewall is using port-based application identification.
AnswersC, D

Without SSL decryption, App-ID cannot inspect encrypted traffic, leading to incorrect or failed identification.

Why this answer

App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.

Exam trap

The trap here is that candidates may think an application override policy ensures correct identification, but in reality it bypasses App-ID entirely, so it does not cause App-ID to fail—it prevents App-ID from running at all.

Practice this question →
27
MCQhard

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

A.SSL decryption must be enabled for the firewall to correctly identify SSL traffic.
B.The firewall is not seeing the full SSL handshake due to asymmetric routing.
C.The default interzone rule is blocking the SSL identification packets.
D.The security policy allows 'web-browsing' before 'ssl' in the rule order.
AnswerB

Asymmetric routing can prevent the firewall from seeing the SSL handshake, causing it to identify the traffic as HTTP.

Why this answer

When a firewall operates as a transparent bridge without SSL decryption, it relies on the Server Name Indication (SNI) field or the certificate exchange during the TLS handshake to identify HTTPS traffic as 'ssl'. Asymmetric routing causes the firewall to see only one direction of the TCP handshake (e.g., only the SYN or only the SYN-ACK), preventing it from observing the full TLS handshake. Without the complete handshake, App-ID cannot extract the necessary signatures (e.g., TLS version, cipher suites, certificate details) and falls back to classifying the traffic as 'web-browsing' based on port 443.

Exam trap

The trap here is that candidates assume SSL decryption is mandatory for SSL identification, but the firewall can identify HTTPS without decryption by inspecting the TLS handshake; the real issue is that asymmetric routing prevents the firewall from seeing the complete handshake, causing App-ID to fall back to port-based classification.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not required for App-ID to identify SSL traffic; the firewall can identify HTTPS by inspecting the TLS handshake metadata (e.g., SNI, certificate) without decrypting the payload. Option C is wrong because interzone rules control traffic flow between zones, not the identification process; App-ID operates before policy enforcement, so a default interzone rule would not prevent the firewall from seeing the SSL handshake packets. Option D is wrong because security policy rule order affects which action is taken on traffic, not how App-ID classifies it; App-ID identifies the application first, then matches it against the policy, so rule order does not cause misidentification.

Practice this question →
28
MCQmedium

A company has an application signature for an internal ERP system that uses a proprietary protocol over TCP port 4444. The ERP traffic is sometimes misidentified as unknown-tcp. Which App-ID mechanism should be used to improve identification without affecting the default App-ID engine?

A.Configure a port-based application override for port 4444.
B.Enable SSL decryption for the ERP traffic.
C.Create a custom application with a data pattern (signature).
D.Create an application override to allow the traffic without App-ID.
AnswerC

Custom applications with data patterns allow App-ID to identify proprietary protocols by inspecting payload content.

Why this answer

Creating a custom application with a data pattern (signature) allows the firewall to identify the ERP traffic based on its unique payload characteristics, without overriding or disabling the default App-ID engine. This approach uses a custom App-ID signature that matches the proprietary protocol's data pattern, ensuring accurate identification while the default engine continues to process other traffic normally.

Exam trap

The trap here is that candidates confuse 'application override' (which bypasses App-ID) with 'custom application signature' (which enhances App-ID), leading them to choose options that disable inspection rather than improve it.

How to eliminate wrong answers

Option A is wrong because a port-based application override statically maps all traffic on TCP 4444 to a specific application, which bypasses the default App-ID engine entirely and prevents it from learning or updating signatures for that port. Option B is wrong because SSL decryption is irrelevant for a proprietary protocol over TCP that does not use SSL/TLS encryption; it would not help identify the application and could introduce unnecessary overhead. Option D is wrong because an application override allows traffic without any App-ID inspection, which defeats the purpose of improving identification and can permit unwanted or malicious traffic to pass unchecked.

Practice this question →
29
MCQeasy

Given the security policy above, what will happen to an HTTP request from a user to a public website?

A.It will be allowed but then blocked by the threat profile.
B.It will be denied because web-browsing is not identified.
C.It will be denied because rule 2 blocks all.
D.It will be allowed because rule 1 matches and action is allow.
AnswerD

Correct: Rule 1 matches web-browsing traffic and allows it.

Why this answer

Rule 1 matches the HTTP request because it typically includes the application 'web-browsing' (or a broader application category) and the action is set to 'allow'. Since security policy evaluation in Palo Alto Networks firewalls is first-match, the traffic is permitted by rule 1 before reaching rule 2. The threat profile does not block the request unless it detects malicious content, which is not indicated in the question.

Exam trap

The trap here is that candidates assume rule 2's 'deny all' will catch the traffic, forgetting that the first-match rule (rule 1) with an 'allow' action takes precedence and terminates policy evaluation.

How to eliminate wrong answers

Option A is wrong because the threat profile only blocks traffic if it matches a threat signature; the question does not specify any threat, so the request is not blocked by the profile. Option B is wrong because web-browsing is identified by App-ID as HTTP traffic to a public website, so it is not denied for lack of identification. Option C is wrong because rule 2 is only evaluated if rule 1 does not match; since rule 1 matches and allows the traffic, rule 2 is never reached.

Practice this question →
30
MCQhard

A network security engineer is troubleshooting an issue where certain VoIP traffic is being dropped by the firewall. The traffic logs show that the application is identified as 'voip' and the security rule allows 'voip'. However, the traffic is still being dropped. What should the engineer check next?

A.Confirm that the VoIP protocol is supported by App-ID.
B.Ensure that the security rule action is set to 'allow' and not 'deny'.
C.Verify that the application override is not set for this traffic.
D.Check if a vulnerability protection profile is dropping the traffic based on a threat signature.
AnswerD

Correct: Security profiles can drop traffic even if the security rule allows the application.

Why this answer

Even when App-ID correctly identifies the traffic as 'voip' and a security rule allows it, a vulnerability protection profile applied to the rule can still drop the traffic if it matches a threat signature. This is a common scenario where the firewall's threat prevention engine, not the security rule, is responsible for the drop. The engineer should inspect the threat logs for any matching signatures.

Exam trap

The trap here is that candidates assume a security rule 'allow' action guarantees traffic passage, overlooking that threat prevention profiles (vulnerability, anti-spyware, etc.) can independently drop traffic after the rule is matched.

How to eliminate wrong answers

Option A is wrong because the traffic logs already show the application is identified as 'voip', indicating App-ID successfully classified it; confirming protocol support is unnecessary. Option B is wrong because the security rule action is already set to 'allow' (as stated in the question), so checking this again would not resolve the drop. Option C is wrong because an application override would force a specific application label, but the logs show 'voip' is already correctly identified, and an override would not cause a drop unless misconfigured; the issue is likely a threat profile, not an override.

Practice this question →
31
Multi-Selecteasy

Which TWO settings must be configured in a security policy rule to ensure the rule only matches when a specific application is detected on its standard port?

Select 2 answers
A.Set the Source Zone and Destination Zone.
B.Enable Threat Prevention.
C.Set the Service to 'application-default'.
D.Configure Logging at session start.
E.Set the Application to the specific application.
AnswersC, E

application-default restricts the rule to the application's default port.

Why this answer

To ensure a security policy rule matches only when a specific application is detected on its standard port, two settings are required: Set the Application to the specific application to match that application's traffic, and set the Service to 'application-default' to restrict matching to the standard port used by that application. This prevents other applications using the same port from triggering the rule. The other options are not directly related to this requirement: Source and Destination zones are necessary for any rule but not specific to application/port matching; Threat Prevention is a separate feature; logging at session start is optional and does not affect matching.

Practice this question →
32
MCQhard

During a security audit, an administrator finds that traffic on TCP port 443 is classified as web-browsing, but the firewall is configured to use SSL decryption. However, the traffic is not decrypted because it uses a self-signed certificate from an internal CA that is not trusted by the firewall. How should the administrator fix this to enable proper App-ID?

A.Configure SSH decryption for the traffic.
B.Disable SSL decryption for that traffic and rely on port-based identification.
C.Import the internal CA certificate and enable SSL forward proxy.
D.Create a custom App-ID override for the application.
AnswerC

This allows the firewall to trust the self-signed certificate and decrypt the traffic.

Why this answer

The firewall cannot decrypt traffic using a self-signed certificate from an internal CA that is not trusted. By importing the internal CA certificate into the firewall and enabling SSL forward proxy, the firewall can generate a trusted, on-the-fly certificate for the session, allowing it to decrypt the traffic and apply App-ID correctly. Without this, the firewall falls back to port-based identification (TCP 443), which misclassifies the traffic as web-browsing instead of the actual application.

Exam trap

The trap here is that candidates assume disabling SSL decryption or using a custom App-ID override is sufficient, but the PCNSE exam tests the understanding that without a trusted CA for forward proxy, the firewall cannot decrypt the traffic, and App-ID will default to port-based identification regardless of any overrides.

How to eliminate wrong answers

Option A is wrong because SSH decryption is used for SSH traffic (TCP port 22), not for HTTPS traffic on TCP 443, and it does not address the SSL decryption certificate trust issue. Option B is wrong because disabling SSL decryption forces the firewall to rely solely on port-based identification, which defeats the purpose of App-ID and will continue to misclassify the traffic as web-browsing. Option D is wrong because creating a custom App-ID override manually assigns an application label to the traffic without decrypting it, which bypasses the security benefits of SSL decryption and does not resolve the underlying certificate trust problem.

Practice this question →
33
MCQmedium

A network engineer wants to reduce the number of applications in security policies by combining several applications that are always used together. What is the best practice?

A.Use a wildcard application for the protocol.
B.Create a custom application that covers all the applications.
C.Configure an application group and add all related applications.
D.Remove the individual applications and just use port-based rules.
AnswerC

Application groups allow grouping for easier policy management.

Why this answer

Using application groups simplifies policy management and ensures consistent policy for related applications. Option A is wrong because wildcard applications are too broad. Option B is wrong because creating a custom container application is not a standard feature.

Option D is wrong because removing applications reduces visibility.

Practice this question →
34
MCQmedium

An engineer wants to block the use of file-sharing application BitTorrent, but allow file transfers over SFTP which also uses port 22. What is the most effective way to achieve this using App-ID?

A.Create an application filter that matches sftp.
B.Use QoS to limit BitTorrent traffic.
C.Use an application override to classify all port 22 traffic as sftp.
D.Create a security rule that denies application 'bittorrent' and allows application 'sftp'.
AnswerD

Correct: This uses App-ID to differentiate and apply appropriate actions per application.

Why this answer

D is correct because App-ID identifies applications by their unique signatures, not just ports. By creating a security rule that denies 'bittorrent' and allows 'sftp', the firewall can block BitTorrent traffic even if it uses non-standard ports, while permitting SFTP on port 22 based on its distinct application signature.

Exam trap

The trap here is that candidates assume port-based rules are sufficient, but App-ID is designed to identify applications by their unique signatures, not ports, so a port-based approach (like an application override) would fail to block BitTorrent if it uses the same port as SFTP.

How to eliminate wrong answers

Option A is wrong because an application filter that matches 'sftp' would only allow SFTP traffic but would not block BitTorrent; it does not deny the unwanted application. Option B is wrong because QoS only prioritizes or limits bandwidth for BitTorrent traffic, it does not block it, leaving the application accessible. Option C is wrong because an application override forces all port 22 traffic to be classified as 'sftp', which would incorrectly allow BitTorrent if it also uses port 22, defeating the purpose of blocking it.

Practice this question →
35
MCQmedium

A large enterprise uses a custom application that communicates over TCP port 8080 using HTTP. The application traffic is correctly identified as 'custom-app' by App-ID. Recently, the development team changed the application to use HTTPS on the same port. The firewall administrator updated the security policy to allow the application, using the same application name, but now the traffic is being denied. The firewall logs show the application as 'ssl' and the action 'deny'. The security policy has a rule that allows 'custom-app' from inside to outside. What should the administrator do to resolve this issue?

A.Create an application override for the traffic on port 8080.
B.Disable App-ID for that traffic and use a port-based policy.
C.Change the security policy rule to allow application 'ssl' instead.
D.Update the custom application definition to include SSL decryption and a hostname match.
AnswerD

This enables the firewall to decrypt and identify the HTTPS traffic as the custom application.

Why this answer

Since the application changed from HTTP to HTTPS on the same port, App-ID now identifies it as 'ssl' instead of 'custom-app' because the traffic is encrypted. To have App-ID recognize the encrypted traffic as the custom application, the administrator must update the custom application definition to include SSL decryption (so the firewall can inspect the encrypted payload) and a hostname match (to distinguish this specific application from other SSL traffic). This allows the existing security policy rule that allows 'custom-app' to match the traffic.

Option A is incorrect because an application override would bypass App-ID entirely, reducing visibility and security. Option B is incorrect because disabling App-ID and using port-based policy loses application awareness and security. Option C is incorrect because changing the rule to allow 'ssl' would permit all SSL traffic on port 8080, which is overly permissive and a security risk.

Practice this question →
36
MCQhard

An administrator is configuring SSL Forward Proxy decryption and wants to ensure that traffic to internal servers with self-signed certificates is decrypted, but traffic to external banking sites is excluded from decryption. They have created a decryption policy with two rules: first rule with 'No Decrypt' for the external banking URLs, second rule with 'Decrypt' for all other traffic. However, the banking traffic is still being decrypted. What is the most likely issue?

A.The SSL Forward Proxy profile is set to ignore the decryption policy.
B.The firewall is using a different decryption port than 443.
C.The decryption policy rules are in the wrong order; the 'Decrypt' rule should be first.
D.The URL category for banking is not correctly identified.
AnswerD

While possible, the more likely issue is rule ordering.

Why this answer

The decryption policy rules are evaluated top-down. The administrator placed the 'No Decrypt' rule first for banking URLs, which is the correct order. However, if the banking URLs do not match the URL category defined in the rule (e.g., the category is not correctly identified or updated), the 'No Decrypt' rule will not apply.

Traffic then falls through to the second 'Decrypt' rule, which decrypts all remaining traffic, including banking. Therefore, the most likely issue is that the URL category for banking is not correctly identified (Option D).

Practice this question →
37
Matchingmedium

Match each PAN-OS component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Handles configuration, logging, and reporting

Processes traffic and enforces security policies

Manages routing and session setup

Collects and stores logs for analysis

Centralized management for multiple firewalls

Why these pairings

PAN-OS architecture separates management, data, and control functions into distinct planes. The Management Plane handles configuration and logging; the Data Plane processes traffic; the Control Plane manages routing and sessions. Panorama is a centralized management tool, not a plane within a single firewall.

Practice this question →
38
MCQhard

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

A.The firewall must be rebooted for the custom App-ID to take effect.
B.An application override rule has not been configured to associate the traffic with the custom App-ID.
C.The custom App-ID must be enabled in the 'Applications' section of the firewall settings.
D.The firewall cannot identify applications over UDP.
AnswerB

Application override is required to bypass signature-based identification and assign the custom App-ID.

Why this answer

The custom App-ID is correctly configured and committed, but the firewall still does not identify the traffic because App-IDs are based on application signatures and behavioral analysis. For a proprietary protocol over UDP, the firewall may not have a signature to match it, so an application override rule is required to explicitly associate the traffic (based on IP, port, or protocol) with the custom App-ID. Without this override, the firewall will continue to treat the traffic as unknown or attempt to match it against built-in App-IDs.

Exam trap

The trap here is that candidates assume a correctly configured custom App-ID will automatically identify traffic, but they overlook the need for an Application Override rule to explicitly bind the traffic to that App-ID when the firewall cannot match it via signatures.

How to eliminate wrong answers

Option A is wrong because rebooting the firewall is unnecessary; custom App-IDs take effect immediately after commit, not requiring a reboot. Option C is wrong because custom App-IDs are not enabled in a separate 'Applications' section; they are created and applied via Security policy rules or Application Override rules. Option D is wrong because Palo Alto Networks firewalls can identify applications over UDP; App-ID supports both TCP and UDP protocols, and the issue is specifically about the lack of a signature for this proprietary protocol.

Practice this question →
39
Multi-Selectmedium

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Select 2 answers
A.Right-clicking on a session in the Traffic log and selecting 'Create App-ID'.
B.Using the 'Application Command Center' to automatically generate custom App-IDs.
C.Using the 'set application' command in the CLI.
D.Importing an App-ID definition file from a CSV.
E.Using the 'Objects' > 'Application Filters' menu in the web interface.
AnswersC, E

CLI allows configuration of custom applications.

Why this answer

The 'set application' CLI command allows you to define a custom App-ID by specifying characteristics such as protocol, port, and signature. This is a direct method to create a custom application object on a Palo Alto Networks firewall, as documented in the administrator's guide.

Exam trap

The trap here is that candidates may confuse 'Create Application Override' (which bypasses App-ID) with 'Create App-ID' (which defines a new application), leading them to select option A, or they may mistakenly think the ACC can generate App-IDs, which it cannot.

Practice this question →
40
MCQeasy

A network administrator wants to ensure that all traffic traversing the firewall is correctly identified by App-ID before any security policies are evaluated. Which step is essential?

A.Enable App-ID on the firewall interfaces.
B.Configure security zones properly.
C.Enable Threat Prevention profiles.
D.Ensure App-ID is enabled in the security policy rules.
AnswerD

App-ID is applied per rule; enabling it ensures identification occurs.

Why this answer

App-ID must be enabled within the security policy rule itself to ensure traffic is identified before policy evaluation. While enabling App-ID on interfaces (Option A) is a prerequisite, the essential step is to configure the security rule to use App-ID as a match criterion; otherwise, the firewall will not perform application identification for that rule. This guarantees that App-ID classification occurs prior to any allow/deny decisions.

Exam trap

The trap here is that candidates often confuse enabling App-ID on interfaces (a prerequisite) with the essential step of actually using App-ID in security rules, leading them to select Option A instead of D.

How to eliminate wrong answers

Option A is wrong because enabling App-ID on interfaces only activates the ability to decode applications at the interface level, but without referencing App-ID in a security rule, the firewall will not enforce application-based policy decisions. Option B is wrong because configuring security zones is a fundamental network segmentation step but does not directly control whether App-ID is applied to traffic; zones are used for policy enforcement, not for enabling App-ID identification. Option C is wrong because Threat Prevention profiles (e.g., IPS, antivirus) are applied after App-ID has already identified the application; they do not ensure that App-ID is used for traffic identification before policy evaluation.

Practice this question →
41
MCQmedium

Dynamics Inc., a mid-sized company, uses Palo Alto Networks PA-5250 firewalls at their data center. They recently deployed a new web-based CRM application that uses HTTPS and WebSocket connections on TCP port 8443. The security team configured a custom application 'crm-app' with a signature that matches the 'Host' header in HTTP requests, and set the protocol decoder to 'tcp' and the port to 8443. The application is used in a security policy to allow traffic from internal users to the CRM server. However, after deployment, the traffic logs show the application is identified as 'ssl' instead of 'crm-app'. The firewall's App-ID and threat prevention subscriptions are active and up to date. The team has verified that the custom application signature is correctly configured, and the traffic clearly matches the defined host header. Which action should be taken to ensure the CRM traffic is correctly identified by App-ID?

A.Increase the 'timeout' value for the custom application signature from 0 to 60 seconds.
B.Modify the custom application signature to use the 'tcp' protocol decoder and set the port to 8443.
C.Disable SSL decryption for the CRM traffic to allow App-ID to inspect the unencrypted HTTP headers.
D.Create a new security rule with an application override that sets the application to 'crm-app' for the CRM traffic.
AnswerD

An application override forces the firewall to identify the traffic as the specified application, bypassing App-ID's detection. This is a valid approach when App-ID fails to correctly classify traffic despite a properly configured custom signature.

Why this answer

When a custom application signature fails to identify traffic due to the firewall's inability to inspect encrypted payloads (like HTTPS/WebSocket), an application override in a security rule forces App-ID to classify the traffic as the specified application regardless of the signature match. Since the CRM traffic uses HTTPS on port 8443, the firewall sees encrypted SSL/TLS handshakes and defaults to 'ssl' App-ID because it cannot inspect the encrypted HTTP headers. An application override bypasses the App-ID identification process and directly assigns the desired application, ensuring correct logging and policy enforcement.

Exam trap

The trap here is that candidates assume a correctly configured custom application signature will always identify traffic, but they overlook that encrypted payloads (HTTPS/WebSocket) prevent the firewall from inspecting HTTP headers, making the signature ineffective without SSL decryption or an application override.

How to eliminate wrong answers

Option A is wrong because increasing the timeout value for a custom application signature affects how long the firewall waits for additional packets to complete identification, but it does not solve the core issue that the encrypted payload prevents the signature from matching the Host header. Option B is wrong because the custom application signature is already configured with the 'tcp' protocol decoder and port 8443 as stated in the scenario; this option suggests a redundant change that does not address the encryption problem. Option C is wrong because disabling SSL decryption would leave the traffic encrypted, preventing App-ID from inspecting the HTTP headers; SSL decryption must be enabled (with a decryption policy) to decrypt the traffic so that the custom signature can match the Host header in the clear.

Practice this question →
42
Drag & Dropmedium

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Configuring a security policy on Palo Alto Networks firewalls involves defining the traffic flow by specifying source and destination zones, then selecting the application and service, setting the action (allow or deny), and finally committing the changes. The correct order ensures logical consistency and proper policy enforcement. Common mistakes include swapping zones, setting action before application, or placing destination after application.

Practice this question →
43
MCQeasy

A security administrator notices that HTTP traffic is correctly identified as web-browsing but HTTPS traffic is showing as ssl. The company uses a custom HTTPS-based application that needs to be identified by its own App-ID. What should the administrator do?

A.Enable SSL decryption on the firewall.
B.Configure a custom URL category for the application.
C.Create an App-ID override (custom application) for the custom application.
D.Disable App-ID for the traffic.
AnswerA

Correct. Enabling SSL decryption allows the firewall to decrypt HTTPS traffic, enabling App-ID to inspect the payload and identify applications. With decryption, the administrator can later create a custom App-ID signature for the custom application.

Why this answer

Enabling SSL decryption (Option A) is the correct first step to identify a custom HTTPS-based application. App-ID cannot inspect encrypted payloads, so SSL decryption allows the firewall to decrypt traffic for inspection. Once decrypted, the administrator can create a custom App-ID signature based on the application's specific characteristics.

Option C is incorrect because an App-ID override is used to bypass App-ID for traffic that should not be inspected, not to define a new application. The question asks for the method to identify the custom application by its own App-ID, and SSL decryption is necessary to enable that identification.

Exam trap

The trap is that candidates often think creating an App-ID override (custom application) is the solution, but an override bypasses App-ID, not creates a signature. The correct approach is to enable SSL decryption to allow App-ID to inspect the decrypted traffic and then define a custom application signature.

How to eliminate wrong answers

Option A is wrong because enabling SSL decryption would decrypt the traffic, allowing App-ID to inspect the payload, but it does not create a custom App-ID for the application; it only enables visibility into encrypted traffic, and the question requires the application to be identified by its own App-ID, not just decrypted. Option B is wrong because configuring a custom URL category categorizes URLs for URL filtering, not for identifying applications via App-ID; App-ID and URL categories are separate functions, and URL categories do not create application signatures. Option D is wrong because disabling App-ID for the traffic would prevent any application identification, including the custom application, which is the opposite of the goal; it would also break security policy enforcement based on application.

Practice this question →
44
Multi-Selectmedium

An engineer is configuring App-ID for a network that uses both standard and custom applications. Which of the following are best practices for using App-ID effectively? (Choose three.)

Select 3 answers
A.Rely solely on default application signatures for all traffic identification.
B.Use application filters to create dynamic application groups based on characteristics.
C.Use application groups to simplify policy management for related applications.
D.Disable App-ID for traffic on well-known ports to reduce processing overhead.
E.Regularly update Application and Threats content to keep signatures current.
AnswersB, C, E

Correct: Filters allow grouping by attributes without manual updates.

Why this answer

Application filters allow you to dynamically group applications based on shared characteristics (e.g., risk, category, technology), which simplifies policy management as new applications matching those criteria are automatically included without manual updates. This is a best practice for scaling App-ID in environments with both standard and custom applications.

Exam trap

The trap here is that candidates may think disabling App-ID on well-known ports reduces overhead (Option D), but App-ID is designed to identify applications irrespective of port, and disabling it creates a security gap that attackers can exploit via port hopping.

Practice this question →
45
MCQmedium

A financial trading firm has a low-latency network. The firewall administrator notices that some trading application traffic is being dropped sporadically. The security policy allows the application 'trading-app' over default port 5000. The logs show the application is identified correctly as 'trading-app', but the action is deny. The administrator checks the security policy and finds that there is a prior rule that denies all traffic with application 'unknown-tcp'. What could be causing the trading application traffic to match the deny rule?

A.The application 'trading-app' is not fully recognized for some sessions, causing fallback to 'unknown-tcp'.
B.The application is identified as both 'trading-app' and 'unknown-tcp' due to a software bug.
C.The traffic is using a non-standard port, so the standard rule does not match.
D.There is a decryption policy causing the application to be misidentified.
AnswerA

Inconsistent identification can occur if the application signature does not match all variations of the traffic.

Why this answer

App-ID uses a multi-pass approach: the first packet is classified based on IP/port, but the application may not be fully identified until several packets are inspected. If the trading application uses a dynamic or non-standard handshake, some sessions may not be recognized as 'trading-app' before the security policy is evaluated, causing them to fall back to 'unknown-tcp' and match the deny rule. This sporadic behavior explains why only some sessions are dropped even though the application is eventually identified correctly.

Exam trap

The trap here is that candidates assume App-ID is instant and always correct on the first packet, but PCNSE tests the understanding that App-ID may require multiple packets to fully identify an application, leading to a temporary 'unknown-tcp' classification that can match a deny rule before the correct application is recognized.

How to eliminate wrong answers

Option B is wrong because App-ID does not assign multiple application labels to the same session; it either identifies the application or falls back to 'unknown-tcp' (or 'incomplete') — a software bug causing dual identification is not a documented behavior. Option C is wrong because the question states the traffic uses default port 5000, and the security policy allows 'trading-app' over that port, so a non-standard port is not the issue. Option D is wrong because decryption policies affect SSL/TLS traffic, but the question does not mention encrypted traffic, and decryption misidentification would not cause fallback to 'unknown-tcp' — it would affect the decrypted application classification, not the initial unknown-tcp fallback.

Practice this question →
46
MCQmedium

A security engineer notices that traffic from a trusted internal application is being blocked by the firewall. The application communicates using a proprietary protocol over TCP port 8443. The engineer has already created a custom App-ID for this application but the traffic is still being blocked. What is the most likely reason?

A.The custom App-ID must be added to a security profile group.
B.The custom App-ID needs a vulnerability profile to be activated.
C.The security policy rule uses the destination port instead of App-ID.
D.An application override rule must be configured to associate the custom App-ID with the traffic.
AnswerD

Application override is necessary to bypass signature-based identification and assign the custom App-ID.

Why this answer

When a custom App-ID is created for a proprietary protocol, the firewall cannot automatically identify the application by inspecting the traffic. An application override rule is required to explicitly map the traffic (based on IP, port, or other criteria) to the custom App-ID, bypassing the firewall's default App-ID identification process. Without this override, the firewall continues to apply its default classification, which may block the traffic if it doesn't match any known application.

Exam trap

The trap here is that candidates assume creating a custom App-ID is sufficient for the firewall to automatically identify the traffic, but they overlook the mandatory step of configuring an application override rule to bind the custom App-ID to the specific traffic flows.

How to eliminate wrong answers

Option A is wrong because a security profile group (which includes vulnerability, anti-virus, and other profiles) is not required for App-ID to function; it is an optional grouping for policy enforcement. Option B is wrong because a vulnerability profile is unrelated to App-ID identification; it is used for threat prevention after traffic is allowed. Option C is wrong because the security policy rule can use App-ID as a match criterion regardless of the destination port; the issue is that the custom App-ID is not being applied to the traffic, not that the rule is misconfigured to use port instead.

Practice this question →
47
MCQhard

A company has a Palo Alto Networks firewall in a high-availability active/passive setup. After a failover event, the new active firewall is not correctly identifying some custom applications. The custom application objects and signatures are synchronized via Panorama. What is the most likely cause?

A.The application override rules are not synchronized.
B.The security policy rules referencing the custom applications are not present.
C.The custom application objects were created locally on the previous active firewall and not pushed from Panorama.
D.The custom application signatures are not committed on the new active firewall.
AnswerC

Correct: Local objects are not shared via Panorama, so they would be missing on the new active firewall.

Why this answer

Custom application objects created locally on the previous active firewall are not automatically synchronized to the peer in an active/passive HA pair. Even though Panorama is used for centralized management, local objects are not pushed from Panorama unless they were originally created and pushed via Panorama. After a failover, the new active firewall lacks these locally defined objects, causing it to fail to identify the custom applications.

Exam trap

The trap here is that candidates assume Panorama synchronization covers all configuration elements, but locally created objects (not pushed from Panorama) are not synced to the HA peer, leading to identification failures after failover.

How to eliminate wrong answers

Option A is wrong because application override rules are part of the security policy configuration and are synchronized via Panorama or HA config sync; they do not affect the identification of custom applications. Option B is wrong because the security policy rules referencing custom applications are present (they are synchronized via Panorama), but the issue is that the custom application objects themselves are missing. Option D is wrong because the custom application signatures are committed on the new active firewall (they were pushed from Panorama), but the locally created objects were never part of the Panorama push.

Practice this question →
48
MCQhard

A managed security service provider (MSSP) manages firewalls for multiple customers. One customer reports that their ERP application traffic is being dropped intermittently. The firewall logs show that the traffic is sometimes identified as 'erp-app' and allowed, and other times identified as 'unknown-tcp' and denied. The ERP application uses a proprietary protocol over TCP port 5555. The firewall has a custom application definition for 'erp-app' that uses a data pattern. The administrator verifies that the data pattern is correct. What should the administrator do to ensure consistent identification?

A.Increase the session timeout for the application.
B.Create a vulnerability protection profile to inspect the traffic.
C.Enable SSL decryption on the firewall.
D.Modify the custom application to include a port condition (default port 5555).
AnswerD

This provides a reliable port-based fallback when the data pattern is not seen.

Why this answer

The issue is that the custom application 'erp-app' relies solely on a data pattern for identification, but if the first packet of a session does not contain the pattern (e.g., due to TCP segmentation or the pattern appearing later in the flow), App-ID may classify the traffic as 'unknown-tcp' and deny it. By adding a port condition (default port 5555) to the custom application, the firewall will first match the traffic based on the TCP port, then inspect subsequent packets for the data pattern, ensuring consistent identification even if the pattern is not in the initial packet.

Exam trap

The trap here is that candidates may think the data pattern alone is sufficient for identification, overlooking that App-ID may need a port condition to anchor the classification when the pattern is not in the initial packet, leading them to choose irrelevant options like session timeout or SSL decryption.

How to eliminate wrong answers

Option A is wrong because increasing the session timeout would not affect how the traffic is initially identified; it only controls how long an idle session remains open, not the App-ID classification. Option B is wrong because vulnerability protection profiles are used to block exploits and malware, not to influence application identification; they operate after App-ID has already classified the traffic. Option C is wrong because SSL decryption is only relevant if the traffic is encrypted (e.g., HTTPS), but the ERP application uses a proprietary protocol over TCP port 5555, which is not encrypted with SSL/TLS; enabling SSL decryption would not help identify the application.

Practice this question →
49
Multi-Selectmedium

Which TWO factors can cause traffic to be classified as 'incomplete' by App-ID? (Choose two.)

Select 2 answers
A.SSL decryption is not enabled for the session.
B.The firewall CPU is too slow to process packets.
C.The content-ID engine has not been licensed.
D.Asymmetric routing where the firewall sees only one direction of traffic.
E.A deny rule that blocks the traffic.
AnswersA, D

Encrypted payload cannot be inspected for application identification.

Why this answer

App-ID classifies a session as 'incomplete' when it cannot identify the application because it sees only partial traffic. SSL decryption not being enabled prevents the firewall from inspecting encrypted payloads, so App-ID cannot complete its signature-based or heuristic analysis, leaving the session marked as incomplete.

Exam trap

The trap here is that candidates often confuse 'incomplete' with 'blocked' or 'error' states, assuming a slow CPU or licensing issue would cause incomplete classification, when in fact incomplete specifically means the firewall lacks sufficient traffic data to identify the application.

Practice this question →
50
Multi-Selecteasy

Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)

Select 2 answers
A.Disable App-ID for traffic that does not match any known application to improve performance.
B.Configure all security policies based on port only for consistency.
C.Use applications instead of ports in security policies.
D.Enable security profiles (e.g., vulnerability protection) along with App-ID.
E.Limit application usage to only well-known applications to reduce attack surface.
AnswersC, D

App-ID provides application-level control.

Why this answer

App-ID is designed to identify traffic based on application signatures, not ports, enabling more granular and accurate security policy enforcement. Using applications instead of ports allows the firewall to control modern applications that may use non-standard ports or hop between ports, which is a core best practice for Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often think disabling App-ID for unknown traffic improves performance (Option A), but this actually creates a security gap; the correct approach is to use 'default' rules with security profiles to handle unknown traffic safely.

Practice this question →
51
MCQeasy

A network administrator notices that web-browsing traffic is being classified as 'incomplete' in the App-ID table. What is the most likely cause?

A.The App-ID signature database is outdated.
B.The security policy does not have an allow rule for web-browsing.
C.The firewall is experiencing asymmetric routing.
D.SSL decryption is not enabled for the traffic.
AnswerD

Without SSL decryption, encrypted traffic cannot be fully inspected, leading to 'incomplete' App-ID.

Why this answer

When SSL decryption is not enabled, the firewall cannot inspect encrypted HTTPS traffic payloads. As a result, App-ID may classify the traffic as 'incomplete' because it cannot match the encrypted payload to the web-browsing application signature. Enabling SSL decryption allows the firewall to decrypt the traffic, inspect the payload, and correctly identify the application.

Exam trap

The trap here is that candidates often assume 'incomplete' means a policy or signature issue, when in fact it specifically indicates that App-ID could not gather enough data from the encrypted session to complete identification, pointing directly to SSL decryption as the root cause.

How to eliminate wrong answers

Option A is wrong because an outdated App-ID signature database would cause unknown or misclassified applications, not specifically an 'incomplete' classification; the 'incomplete' status is a result of insufficient data for identification, not missing signatures. Option B is wrong because the security policy's allow rule determines whether traffic is permitted or blocked, not how it is classified in the App-ID table; 'incomplete' is a classification status, not a policy action. Option C is wrong because asymmetric routing can cause session setup issues or traffic to be dropped, but it does not directly cause App-ID to classify traffic as 'incomplete'; App-ID relies on the first few packets of a session, and asymmetric routing would more likely result in session timeouts or non-symmetric flow errors.

Practice this question →
52
MCQeasy

A school district wants to allow YouTube for Education (a subcategory of YouTube) but block general YouTube traffic. The firewall uses URL filtering and App-ID. Currently, all YouTube traffic is identified as 'youtube' application, and the URL filtering category is 'educational-videos' for the education version. The administrator creates a security rule that allows application 'youtube' and URL category 'educational-videos'. However, all YouTube traffic is being blocked. What is the most likely cause?

A.The rule must also specify the source zone.
B.The application 'youtube' matches all YouTube traffic, so the URL category does not further filter because the application is matched first.
C.The URL category is not being applied because the traffic is encrypted and SSL decryption is not enabled.
D.The URL filtering license is not installed or expired.
AnswerC

Without decryption, the firewall cannot see the URL, so the URL category condition never matches.

Why this answer

When traffic is encrypted (HTTPS), the firewall cannot inspect the URL path or query parameters unless SSL decryption is enabled. Without decryption, URL filtering relies on the Server Name Indication (SNI) or IP address, which may not distinguish between 'youtube' and 'youtube.com/education' traffic. Since the rule requires both the application 'youtube' and the URL category 'educational-videos', the firewall cannot match the URL category for encrypted YouTube traffic, causing all YouTube traffic to be blocked by the implicit deny rule.

Exam trap

The trap here is that candidates assume App-ID and URL filtering are independent and always work together, but they overlook that URL filtering on encrypted traffic requires SSL decryption to inspect the URL path, a nuance frequently tested in PCNSE questions about decryption policies.

How to eliminate wrong answers

Option A is wrong because the source zone is not required for URL filtering to work; a rule without a source zone will match all zones, and the issue is not about zone matching but about the inability to evaluate the URL category on encrypted traffic. Option B is wrong because when both App-ID and URL filtering are used in a rule, the firewall evaluates both conditions; App-ID identifies the application (e.g., 'youtube'), and URL filtering further refines based on the URL category, so the application match does not prevent URL category evaluation. Option D is wrong because if the URL filtering license were missing or expired, the firewall would not apply any URL category match, but the question states that the URL category 'educational-videos' is recognized, and the issue is specifically that encrypted traffic prevents URL category lookup.

Practice this question →
53
Matchingmedium

Match each decryption type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Decrypts outbound traffic to inspect it

Decrypts inbound traffic to servers

Decrypts SSH traffic for policy enforcement

Traffic bypasses decryption

Sends decrypted traffic to a monitoring tool

Why these pairings

Correct matches: SSL Forward Proxy decrypts outbound traffic; SSL Inbound Inspection decrypts inbound traffic; SSH Proxy inspects SSH; Decryption Mirror duplicates decrypted traffic. Common confusion is swapping the direction of SSL decryption types.

Practice this question →
54
MCQeasy

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

A.Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.
B.Create a security rule with destination port 80 and 443 and action set to 'allow'.
C.Create a security profile that blocks all applications not in the allow list.
D.Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.
AnswerA

This rule allows only the specified applications.

Why this answer

App-ID allows you to create a security rule that explicitly allows only the specified applications ('facebook-base' and 'youtube') while implicitly denying all other traffic. Since the default action for any traffic not matching an allow rule is 'deny', this rule achieves the goal of blocking all other applications without needing an explicit block rule.

Exam trap

The trap here is that candidates often confuse port-based rules (Option B) with application-based rules, assuming that allowing ports 80/443 is sufficient to control application access, but App-ID is required to distinguish between applications using the same port.

How to eliminate wrong answers

Option B is wrong because allowing destination ports 80 and 443 would permit all HTTP/HTTPS traffic, including applications like 'facebook-base' and 'youtube', but it would also allow many other web-based applications (e.g., 'twitter', 'dropbox'), failing to block them. Option C is wrong because security profiles (e.g., Antivirus, Vulnerability Protection) do not control which applications are allowed or blocked; they inspect traffic that is already permitted by the security rule's action. Option D is wrong because URL filtering rules control access based on URL categories, not application identities; 'social-networking' and 'multimedia' categories would include many applications beyond just 'facebook-base' and 'youtube', and URL filtering cannot enforce application-level granularity like App-ID can.

Practice this question →
55
Multi-Selecteasy

A security administrator needs to block an application that uses multiple ports, including dynamic ports. Which of the following methods can be used to block this application using App-ID? (Choose two.)

Select 2 answers
A.Create an application override to force identification of the application on all ports.
B.Create a security rule with the application set to the malicious application and action Deny.
C.Use decryption to inspect the application content.
D.Create a custom application with multiple default ports.
E.Create a security rule with the destination port range that covers all possible ports.
AnswersB, D

Correct: Denying by application blocks the traffic regardless of port.

Why this answer

App-ID identifies applications regardless of port, so a security rule with the application set to the malicious application and action Deny will block that application even when it uses dynamic ports. This leverages App-ID's ability to classify traffic based on application signatures, not just port numbers.

Exam trap

The trap here is that candidates often assume port-based blocking (Option E) is sufficient for applications using dynamic ports, but App-ID's port-agnostic identification is the correct approach, and they may also confuse application override (Option A) as a blocking mechanism rather than a classification tool.

Practice this question →
56
MCQmedium

A security team is deploying SSL Decryption for inbound traffic to protect against threats hidden in encrypted traffic. However, they want to exclude financial transactions that use client certificates for authentication. What is the best approach?

A.Create a decryption policy rule with a condition matching the client certificate.
B.Create a decryption policy rule that excludes the financial application based on URL category.
C.Use an SSL Forward Proxy decryption profile with 'Exclude Certificate' list.
D.Use a decryption policy rule with 'No Decrypt' action for the financial application.
AnswerD

Correct: This directly excludes traffic identified as the financial application from decryption.

Why this answer

The security team needs to exclude specific traffic from SSL decryption without blocking it. A 'No Decrypt' action in a decryption policy rule allows the firewall to bypass decryption for matched traffic while still permitting it to pass through. This is the standard method for excluding sensitive traffic like financial transactions that use client certificates for authentication, as it avoids breaking mutual authentication or violating compliance requirements.

Exam trap

The trap here is that candidates confuse the 'Exclude Certificate' list (which excludes specific server certificates from decryption) with the need to exclude traffic based on client certificate authentication, leading them to incorrectly choose Option C.

How to eliminate wrong answers

Option A is wrong because decryption policy rules do not match on client certificates; they match on source/destination zones, IP addresses, URL categories, or server certificate attributes, not client-side certificates. Option B is wrong because excluding based on URL category is too broad and may not accurately identify all financial transactions that use client certificates, potentially missing some or excluding non-financial traffic. Option C is wrong because the 'Exclude Certificate' list in an SSL Forward Proxy decryption profile is used to exclude specific server certificates from decryption, not to handle client certificate authentication scenarios.

Practice this question →
57
MCQhard

During a security audit, it is discovered that a custom application signature matches too broadly, causing benign traffic to be classified as the custom app. What change should be made to narrow the signature?

A.Remove the protocol field from the signature.
B.Use a wider port range and remove data patterns.
C.Add a data pattern filter to match a specific payload signature.
D.Expand the port range to include more traffic.
AnswerC

Data patterns narrow matching to specific traffic characteristics.

Why this answer

Adding a data pattern filter allows the custom App-ID signature to match on a specific payload string or byte sequence, which narrows the scope of traffic classified as that application. Without a data pattern, the signature may rely solely on IP protocol, port, or other broad criteria, causing false positives. By requiring a unique payload signature, only traffic containing that exact data pattern is identified as the custom application.

Exam trap

The trap here is that candidates mistakenly think expanding port ranges or removing protocol fields will narrow the signature, when in fact those actions broaden the match criteria and worsen false positives.

How to eliminate wrong answers

Option A is wrong because removing the protocol field would make the signature even broader, potentially matching any IP traffic regardless of protocol (TCP, UDP, etc.), increasing false positives. Option B is wrong because using a wider port range and removing data patterns would expand the matching criteria, making the signature less specific and more likely to misclassify benign traffic. Option D is wrong because expanding the port range includes more traffic, which would broaden the signature and worsen the over-matching issue, not narrow it.

Practice this question →
58
Multi-Selecthard

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Select 3 answers
A.Multiple security rules are configured for the same traffic.
B.Asymmetric routing causes the firewall to see only one direction of traffic.
C.SSL decryption is not enabled for the traffic.
D.IP fragmentation occurs before the firewall.
E.Traffic is forwarded through an HTTP proxy.
AnswersB, C, D

Asymmetric routing can prevent the firewall from seeing the full session, causing inaccurate identification.

Why this answer

Asymmetric routing causes App-ID to see only one direction of traffic (e.g., SYN but no SYN-ACK). App-ID relies on bidirectional flow inspection to identify applications; without seeing both directions, the firewall cannot complete the application signature match or protocol handshake, leading to incorrect or failed identification.

Exam trap

The trap here is that candidates often think IP fragmentation is a rare or non-impactful scenario, but it directly prevents App-ID from seeing complete application headers, making it a common cause of misidentification in real-world networks.

Practice this question →
59
MCQmedium

An organization uses a SaaS application that runs on a dynamic set of IP addresses. The application traffic is currently identified as ssl and not as the specific application. How can the administrator improve application identification for this SaaS application?

A.Disable App-ID for that traffic to reduce overhead.
B.Create a custom application with hostname conditions.
C.Use a port-based application override.
D.Configure a URL filtering category for the application.
AnswerB

Hostname conditions match the SNI in TLS, allowing identification even with dynamic IPs.

Why this answer

App-ID can identify SaaS applications by hostname conditions when the application uses a dynamic set of IP addresses. By creating a custom application with hostname conditions (e.g., matching the FQDN of the SaaS service), the firewall can accurately identify the traffic as that specific application rather than generic SSL, even as the backend IPs change. This leverages the firewall's ability to inspect the Server Name Indication (SNI) field in the TLS handshake or the HTTP Host header.

Exam trap

The trap here is that candidates often assume port-based overrides (Option C) are the only way to identify traffic, but they fail to recognize that hostname-based conditions in custom applications provide a more precise and dynamic identification method for SaaS applications with changing IP addresses.

How to eliminate wrong answers

Option A is wrong because disabling App-ID would prevent all application identification, making the traffic even less identifiable and defeating the purpose of improving application identification. Option C is wrong because a port-based application override maps traffic to an application based solely on the destination port (e.g., TCP 443), which would not distinguish this SaaS application from any other HTTPS traffic and would not leverage hostname or SNI. Option D is wrong because URL filtering categories are based on URL patterns and categories, not on application identity; configuring a URL filtering category would not change how App-ID classifies the traffic, and the traffic would still be identified as ssl rather than the specific application.

Practice this question →
60
MCQmedium

An engineer checks the application counter and sees that my-custom-app has zero packets, but they expected traffic from 10.0.0.0/24 to 10.1.0.0/24 to be identified as my-custom-app. What is the most likely reason?

A.The traffic is being identified as ssl instead.
B.The application override rule does not have the correct port.
C.The security policy does not allow the traffic.
D.The custom application my-custom-app is not committed.
AnswerB

Correct: Without a port, the override rule does not trigger, and traffic is identified normally.

Why this answer

An application override rule explicitly maps traffic to a custom application based on IP address, protocol, and port. If the port in the override rule does not match the actual destination port used by the traffic (e.g., TCP/8080 instead of TCP/80), the firewall will not classify the traffic as my-custom-app, resulting in zero packets for that application counter. The traffic may still pass but will be identified by App-ID as another application or remain unidentified.

Exam trap

The trap here is that candidates often assume the issue is with the security policy blocking traffic (Option C) or with the application not being committed (Option D), but the zero-packet counter specifically for the custom app points to a matching failure in the override rule, not a policy or commit problem.

How to eliminate wrong answers

Option A is wrong because if the traffic were identified as ssl, the application counter for my-custom-app would still show zero packets, but the question states the engineer expected the traffic to be identified as my-custom-app, implying an override or custom signature is in place; SSL identification would only occur if no override matched and App-ID detected SSL handshake, which is not the most likely reason given the expectation of a custom app. Option C is wrong because if the security policy did not allow the traffic, the packets would be dropped and the application counter for my-custom-app would still show zero, but the engineer would likely see deny logs or zero byte counts across all counters, not just the custom app; the question focuses on identification, not permission. Option D is wrong because if my-custom-app were not committed, the application object would not exist in the running configuration, and the firewall would not have a counter for it at all; the fact that the counter exists and shows zero packets indicates the object is committed but not matching traffic.

Practice this question →
61
MCQeasy

A company uses a Palo Alto Networks firewall with App-ID enabled. They have a custom application that communicates over TCP port 5001. The administrator has created a custom App-ID signature and a security rule that allows this application from the internal zone (trust) to the external zone (untrust). Users report that the custom application traffic is being blocked. The administrator checks the traffic logs and sees that the sessions are being matched to a different security rule that denies any traffic from trust to untrust. The deny rule appears before the custom allow rule in the policy list. The custom App-ID signature is properly defined and tested. What should the administrator do to resolve this issue?

A.Modify the custom App-ID signature to match more precisely.
B.Create an application override for the custom application.
C.Add a virtual wire interface to ensure traffic reaches the firewall.
D.Reorder the security rules so the custom allow rule is above the deny rule.
AnswerD

Placing the more specific allow rule before the broad deny rule ensures the traffic matches the correct rule.

Why this answer

Security rules in Palo Alto Networks firewalls are evaluated in top-down order, and the first matching rule is applied. Since the deny rule appears before the custom allow rule, all traffic matching the deny rule's criteria (including the custom application) is blocked before reaching the allow rule. Reordering the rules so the custom allow rule is above the deny rule ensures the custom application traffic is permitted as intended.

Exam trap

The trap here is that candidates often focus on App-ID configuration (options A or B) rather than recognizing that the fundamental issue is rule ordering, which is a core concept in Palo Alto Networks policy evaluation.

How to eliminate wrong answers

Option A is wrong because the custom App-ID signature is already properly defined and tested, so modifying it further would not change the rule-matching order; the issue is policy ordering, not signature accuracy. Option B is wrong because an application override bypasses App-ID identification by forcing the firewall to treat traffic as a specific application, but this does not resolve the rule-order problem; the traffic would still hit the deny rule first. Option C is wrong because a virtual wire interface is a deployment mode for transparent inline inspection and does not affect security rule evaluation order or traffic matching; the firewall is already receiving the traffic.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Securing Traffic and App-ID questions.

Start 20-question session