Courseiva
Securing Traffic and App-IDhardMultiple ChoiceObjective-mapped

PCNSE Securing Traffic and App-ID Practice Question

Exhibit

Refer to the exhibit.

show system state | match appid
total appid sessions: 12000
appid pending sessions: 4500
appid complete sessions: 7500
appid error sessions: 0

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

⚠ Common exam trap

Many candidates assume a high number of pending App-ID sessions is caused by a lack of signatures or decryption, when in fact it is typically a symptom of rulebase inefficiency that forces excessive traffic through the App-ID engine.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.

When security policy rules are not optimized, excessive traffic may be processed by App-ID, causing a backlog of sessions waiting for application identification. The firewall's dataplane can become overwhelmed if too many sessions require deep packet inspection before a decision is made, leading to high CPU utilization and a large number of pending App-ID sessions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • An application override policy is being used extensively.

    Why it's wrong here

    Application override bypasses App-ID, so it would not increase pending sessions.

  • Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.

    Why this is correct

    Poorly designed security policies can cause unnecessary traffic to be inspected, leading to a high number of pending sessions.

  • SSL decryption is disabled for most traffic.

    Why it's wrong here

    Disabling decryption reduces the amount of traffic that App-ID needs to inspect, decreasing pending sessions.

  • The application database is outdated and missing signatures.

    Why it's wrong here

    Missing signatures would likely cause error sessions, not pending sessions.

About these practice questions

This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.