PCNSE Core Concepts and Architecture Practice Question
Which THREE factors are considered when a Palo Alto Networks firewall performs application identification (App-ID) on a session? (Choose three.)
⚠ Common exam trap
Watch out — candidates often assume IP addresses are used in application identification, but App-ID relies solely on transport and application-layer data, not network-layer addressing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application signatures and decrypted content
App-ID uses multiple factors to identify applications, including application signatures that match traffic patterns and decrypted content when SSL decryption is enabled. Protocol (TCP/UDP) is considered because many applications are tied to specific transport protocols. Source and destination port numbers are also considered, though they are not definitive; they help narrow down the application candidate set.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application signatures and decrypted content
Why this is correct
Signatures and content inspection are key to accurate identification.
- ✓
Protocol (TCP/UDP)
Why this is correct
Protocol type is considered in the identification process.
- ✓
Source and destination port numbers
Why this is correct
Port numbers are part of the initial identification heuristics.
- ✗
Destination IP address of the packet
Why it's wrong here
Destination IP is not used for App-ID.
- ✗
Source IP address of the packet
Why it's wrong here
Source IP is not a factor for application identification.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.