PCNSE Securing Traffic and App-ID Practice Question
During a security audit, an administrator finds that traffic on TCP port 443 is classified as web-browsing, but the firewall is configured to use SSL decryption. However, the traffic is not decrypted because it uses a self-signed certificate from an internal CA that is not trusted by the firewall. How should the administrator fix this to enable proper App-ID?
⚠ Common exam trap
A common mix-up: candidates assume disabling SSL decryption or using a custom App-ID override is sufficient, but the PCNSE exam tests the understanding that without a trusted CA for forward proxy, the firewall cannot decrypt the traffic, and App-ID will default to port-based identification regardless of any overrides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Import the internal CA certificate and enable SSL forward proxy.
The firewall cannot decrypt traffic using a self-signed certificate from an internal CA that is not trusted. By importing the internal CA certificate into the firewall and enabling SSL forward proxy, the firewall can generate a trusted, on-the-fly certificate for the session, allowing it to decrypt the traffic and apply App-ID correctly. Without this, the firewall falls back to port-based identification (TCP 443), which misclassifies the traffic as web-browsing instead of the actual application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure SSH decryption for the traffic.
Why it's wrong here
SSH decryption is for SSH traffic, not HTTPS.
- ✗
Disable SSL decryption for that traffic and rely on port-based identification.
Why it's wrong here
Disabling decryption would prevent App-ID from accurately identifying the application.
- ✓
Import the internal CA certificate and enable SSL forward proxy.
Why this is correct
This allows the firewall to trust the self-signed certificate and decrypt the traffic.
- ✗
Create a custom App-ID override for the application.
Why it's wrong here
An override does not solve the decryption problem; the traffic remains encrypted.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.