PCNSE Securing Traffic and App-ID Practice Question
Which TWO are best practices when configuring App-ID for a production environment? (Choose two.)
⚠ Common exam trap
Watch out — candidates often think disabling App-ID for unknown traffic improves performance (Option A), but this actually creates a security gap; the correct approach is to use 'default' rules with security profiles to handle unknown traffic safely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use applications instead of ports in security policies.
App-ID is designed to identify traffic based on application signatures, not ports, enabling more granular and accurate security policy enforcement. Using applications instead of ports allows the firewall to control modern applications that may use non-standard ports or hop between ports, which is a core best practice for Palo Alto Networks firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable App-ID for traffic that does not match any known application to improve performance.
Why it's wrong here
Should not disable; unknown traffic may be malicious.
- ✗
Configure all security policies based on port only for consistency.
Why it's wrong here
Port-based policies lose App-ID benefits.
- ✓
Use applications instead of ports in security policies.
Why this is correct
App-ID provides application-level control.
- ✓
Enable security profiles (e.g., vulnerability protection) along with App-ID.
Why this is correct
Combined layers provide defense in depth.
- ✗
Limit application usage to only well-known applications to reduce attack surface.
Why it's wrong here
May block legitimate unknown apps.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.