Courseiva
Securing Traffic and App-IDmediumMultiple SelectObjective-mapped

PCNSE Securing Traffic and App-ID Practice Question

Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?

⚠ Common exam trap

Test-takers frequently confuse application override with custom application creation, thinking that an override helps identify the application, when in fact it bypasses App-ID entirely and only assigns a static label.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Create a custom application with a hostname condition.

A custom application can be defined with a hostname condition to match traffic based on the SNI field in the TLS handshake, which allows App-ID to identify the application even when it uses a non-standard port like 8443. Option E is correct because enabling SSL forward proxy with the internal CA certificate allows the firewall to decrypt the SSL/TLS traffic and inspect the application payload, which is necessary for App-ID to accurately identify the custom application.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Disable App-ID on port 8443.

    Why it's wrong here

    Disabling App-ID prevents identification.

  • Use an application override with port 8443.

    Why it's wrong here

    Override bypasses App-ID.

  • Add a custom URL category for the domain.

    Why it's wrong here

    URL categories do not influence App-ID.

  • Create a custom application with a hostname condition.

    Why this is correct

    Hostname condition matches the SNI to identify the application.

  • Enable SSL forward proxy and import the internal CA certificate.

    Why this is correct

    Decryption is needed to access SNI for hostname-based identification.

Visual reference

Client Server SYN (seq=100) SYN-ACK (seq=200, ack=101) ACK (ack=201) Connection established — data transfer begins

About these practice questions

One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.