PCNSE Securing Traffic and App-ID Practice Question
Which TWO actions can help App-ID correctly identify a custom application that communicates over TCP port 8443 using SSL/TLS with a known internal hostname?
⚠ Common exam trap
Test-takers frequently confuse application override with custom application creation, thinking that an override helps identify the application, when in fact it bypasses App-ID entirely and only assigns a static label.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom application with a hostname condition.
A custom application can be defined with a hostname condition to match traffic based on the SNI field in the TLS handshake, which allows App-ID to identify the application even when it uses a non-standard port like 8443. Option E is correct because enabling SSL forward proxy with the internal CA certificate allows the firewall to decrypt the SSL/TLS traffic and inspect the application payload, which is necessary for App-ID to accurately identify the custom application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable App-ID on port 8443.
Why it's wrong here
Disabling App-ID prevents identification.
- ✗
Use an application override with port 8443.
Why it's wrong here
Override bypasses App-ID.
- ✗
Add a custom URL category for the domain.
Why it's wrong here
URL categories do not influence App-ID.
- ✓
Create a custom application with a hostname condition.
Why this is correct
Hostname condition matches the SNI to identify the application.
- ✓
Enable SSL forward proxy and import the internal CA certificate.
Why this is correct
Decryption is needed to access SNI for hostname-based identification.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.