Knowledge + Practice

CCNA App-ID and Content-ID Questions

60 questions · App-ID and Content-ID · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

A large university uses a Palo Alto Networks firewall to secure its network. The security team has implemented a policy to block peer-to-peer (P2P) file sharing applications. They have configured a security rule that denies all applications in the 'peer-to-peer' category. However, they notice that some students are still able to download files using BitTorrent. The traffic logs show the application as 'bittorrent' but the rule does not match. Upon investigation, the rule is applied to the correct zones and includes the peer-to-peer category. The source and destination are any. What is the most likely cause of this issue?

A.BitTorrent is not part of the peer-to-peer application category.

B.The security rule is using an application group instead of an application filter.

C.The firewall does not have the latest App-ID update and cannot identify BitTorrent.

D.The rule is placed after an allow rule that matches the traffic.

AnswerD

If a preceding rule allows the traffic, the deny rule will not be evaluated.

Why this answer

Option D is correct because in Palo Alto Networks firewalls, security rules are evaluated in order from top to bottom. If a rule that allows traffic (e.g., a broad allow rule) is placed before the deny rule for peer-to-peer applications, the traffic will match the allow rule first and be permitted, never reaching the deny rule. This is a common misconfiguration where rule ordering overrides the intended policy, even when the deny rule is correctly configured with the peer-to-peer category.

Exam trap

The trap here is that candidates often focus on App-ID configuration details (like categories or updates) and overlook the fundamental concept of rule ordering, which is a common cause of policy bypass in firewall management.

How to eliminate wrong answers

Option A is wrong because BitTorrent is indeed classified under the 'peer-to-peer' application category in Palo Alto Networks App-ID, so the category should match. Option B is wrong because the question states the rule includes the 'peer-to-peer category', which can be applied via an application filter or group; using an application group would still work if it contains the correct applications, but the issue is rule ordering, not the method of application selection. Option C is wrong because the traffic logs show the application as 'bittorrent', meaning App-ID has successfully identified it; a missing update would result in 'incomplete' or 'unknown' application identification, not a correctly identified application that fails to match.

Practice this question →

2

MCQeasy

A security administrator wants to block all traffic using the BitTorrent protocol regardless of port. Which method should they use?

A.Use URL Filtering to block BitTorrent.

B.Create a security rule with Application set to 'bittorrent' and Action set to 'Deny'.

C.Use Data Filtering to block BitTorrent traffic.

D.Block the commonly used ports for BitTorrent.

AnswerB

App-ID identifies BitTorrent across any port.

Why this answer

Option B is correct because Palo Alto Networks firewalls use App-ID to identify applications like BitTorrent by their unique signatures, regardless of port or encryption. By creating a security rule with the application set to 'bittorrent' and action set to 'Deny', the firewall blocks all BitTorrent traffic even if it uses non-standard ports or tries to masquerade as other protocols.

Exam trap

The trap here is that candidates often default to port-based blocking (Option D) or think URL Filtering (Option A) can block application traffic, failing to recognize that App-ID is the only method that can identify and block applications like BitTorrent irrespective of port or encryption.

How to eliminate wrong answers

Option A is wrong because URL Filtering is designed to block access to specific websites or URL categories, not to identify or block application-layer protocols like BitTorrent. Option C is wrong because Data Filtering is used to block or alert on sensitive data patterns (e.g., credit card numbers) within allowed traffic, not to block entire application protocols. Option D is wrong because BitTorrent can dynamically use any port (including port 80 or 443) to evade simple port-based blocking, making port-based rules ineffective.

Practice this question →

3

MCQeasy

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

A.URL Filtering Profile

B.Application Override

C.File Blocking Profile

D.Data Filtering Profile

AnswerD

Data filtering inspects content for patterns.

Why this answer

Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Exam trap

The trap here is that candidates often confuse Data Filtering with File Blocking, assuming that blocking file attachments is sufficient to prevent data loss, but Data Filtering is specifically designed to inspect and block sensitive text patterns within the body of webmail or other application traffic.

How to eliminate wrong answers

Option A is wrong because URL Filtering Profile controls access to websites based on URL categories and reputation, not the content within webmail messages. Option B is wrong because Application Override is used to force a specific application signature for traffic that is not correctly identified, not to inspect or filter data content. Option C is wrong because File Blocking Profile blocks specific file types (e.g., .exe, .zip) based on file name or type, but it cannot inspect the body of an email for patterns like credit card numbers.

Practice this question →

4

MCQmedium

A company uses App-ID to control cloud storage applications. Users report that uploads to Google Drive are blocked even though a rule allows 'google-drive-base'. What is the most likely cause?

A.The firewall is not connected to the cloud for App-ID updates.

B.The rule allows only 'google-drive-base' but the uploads use 'google-drive-upload'.

C.Decryption is not enabled for Google Drive traffic.

D.An application override is configured for Google Drive.

AnswerB

Google Drive has multiple sub-apps; uploads are a different app-ID.

Why this answer

App-ID uses multiple application signatures to identify different functions within an application. 'google-drive-base' covers basic Google Drive traffic, but uploads are typically identified by a separate application signature, 'google-drive-upload'. Since the rule only allows 'google-drive-base', the firewall blocks the upload traffic because it does not match the permitted application. This is a common scenario where granular App-ID signatures must be explicitly allowed for specific actions like uploads.

Exam trap

The trap here is that candidates assume a single application signature like 'google-drive-base' covers all traffic for that application, but Palo Alto Networks App-ID often splits applications into multiple sub-application signatures for granular control, and failing to allow the specific sub-application for uploads will result in blocked traffic.

How to eliminate wrong answers

Option A is wrong because App-ID updates are not required for the firewall to recognize Google Drive sub-applications; the signatures are already present in the initial App-ID database and are updated via dynamic updates, but the issue here is a policy misconfiguration, not a connectivity problem. Option C is wrong because decryption is not a prerequisite for App-ID to identify Google Drive traffic; App-ID can identify applications using unencrypted metadata and heuristics, and while decryption improves accuracy, its absence does not cause a specific 'google-drive-upload' signature to be blocked if the rule allows only 'google-drive-base'. Option D is wrong because an application override would replace App-ID identification with a static application definition, which would not cause a selective block of uploads; instead, it would either allow or block all Google Drive traffic based on the override, not differentiate between base and upload functions.

Practice this question →

5

MCQhard

After a security policy change, users complain that they cannot upload files to a custom web application. The rule allows the custom application 'webapp' and Content-ID is enabled. What is the most likely cause?

A.The application 'webapp' is not allowed due to an application override.

B.SSL decryption is not enabled.

C.A file blocking profile is blocking the upload.

D.App-ID is not identifying the application correctly.

AnswerC

File blocking is part of Content-ID and can prevent uploads.

Why this answer

The correct answer is C because a file blocking profile, when enabled with Content-ID, can block uploads of specific file types even if the application itself is allowed. In this scenario, the rule permits the custom application 'webapp' and Content-ID is enabled, so the most likely reason for upload failure is that a file blocking profile is configured to block the file type being uploaded, not an issue with App-ID or SSL decryption.

Exam trap

The trap here is that candidates often assume the issue is with App-ID misidentification or SSL decryption, but the question explicitly states the application is allowed and Content-ID is enabled, pointing directly to a file blocking profile as the cause of the upload failure.

How to eliminate wrong answers

Option A is wrong because an application override would explicitly allow or deny the application, but the rule already allows 'webapp', so an override would not cause a block unless it was set to deny, which is not indicated. Option B is wrong because SSL decryption is not required for file uploads to a custom web application unless the traffic is encrypted and App-ID or Content-ID needs to inspect the payload; the question does not mention HTTPS, so lack of decryption is not the most likely cause. Option D is wrong because App-ID is correctly identifying the application as 'webapp' (since the rule allows it), and Content-ID is enabled, so the issue is not with identification but with a security profile blocking the upload.

Practice this question →

6

MCQhard

A Palo Alto Networks firewall is configured with a security rule that allows 'web-browsing' and has a URL Filtering Profile to block 'malware' sites. However, users can still access known malware URLs. What is the most likely cause?

A.The 'malware' URL Category is not added to the security rule's URL Category list.

B.The 'web-browsing' application is not being identified correctly by App-ID.

C.SSL Decryption is not enabled, so the firewall cannot inspect HTTPS URLs.

D.The URL Filtering Profile is not applied to the correct security rule.

AnswerD

Without proper application, the profile has no effect.

Why this answer

The most likely cause is that the URL Filtering Profile is not applied to the correct security rule. Even if a security rule allows 'web-browsing' and a URL Filtering Profile is configured to block 'malware' sites, the profile must be explicitly attached to that rule in the 'Actions' tab under 'Profile Group' or 'URL Filtering Profile'. If it is applied to a different rule or not applied at all, the firewall will not enforce the URL filtering action, allowing access to known malware URLs.

Exam trap

The trap here is that candidates often assume URL Filtering Profiles are automatically applied when a security rule allows web-browsing, but they must be explicitly attached to the rule, and the question tests this specific configuration requirement.

How to eliminate wrong answers

Option A is wrong because the 'malware' URL Category does not need to be added to the security rule's URL Category list; URL Filtering Profiles operate independently of the rule's category list and are applied via a profile setting. Option B is wrong because the 'web-browsing' application is a standard, well-defined application that App-ID reliably identifies using multiple signatures (e.g., HTTP header analysis, port 80/443 traffic patterns); misidentification is unlikely to be the cause here. Option C is wrong because SSL Decryption is not required for URL Filtering to inspect HTTPS URLs; the firewall can still perform URL categorization based on the Server Name Indication (SNI) field in the TLS handshake or the IP address, even without decryption.

Practice this question →

7

Multi-Selecthard

Which THREE are valid components of Content-ID? (Choose three.)

Select 3 answers

A.Application Filters

B.Application Override

C.URL Filtering

D.File Blocking

E.Data Filtering

AnswersC, D, E

URL Filtering is a Content-ID feature.

Why this answer

Options A, C, and D are correct because Content-ID includes URL Filtering, File Blocking, and Data Filtering. Option B is wrong because Application Override is part of App-ID, not Content-ID. Option E is wrong because Application Filters are part of App-ID.

Practice this question →

8

MCQmedium

A financial services company uses a Palo Alto Networks firewall to protect its customer data. They have a requirement to block all file transfers that contain credit card numbers (PCI compliance). The firewall has Data Filtering profiles configured to detect credit card patterns. However, the security team notices that some file transfers containing credit card numbers are not being blocked. The traffic logs show the applications are identified correctly, and the security rule has the Data Filtering profile attached. The Data Filtering profile is configured with a rule to block 'Credit Card Numbers' with a threshold of 1. What could be the issue?

A.The Data Filtering profile does not include the specific applications that are transferring files.

B.The Data Filtering profile is not attached to the security rule.

C.The security rule is not logging the Data Filtering alerts.

D.SSL decryption is not enabled for the traffic.

AnswerA

Data Filtering profiles must specify which applications to inspect; if the application is not listed, no filtering occurs.

Why this answer

Option A is correct because Data Filtering profiles are applied per application. If the specific applications used for file transfers (e.g., custom or less common apps) are not selected within the Data Filtering profile, the firewall will not inspect those transfers for credit card numbers, even if the security rule has the profile attached. The profile must explicitly include the applications to enforce the data filtering rules.

Exam trap

The trap here is that candidates assume attaching a Data Filtering profile to a security rule automatically applies it to all traffic matching the rule, but the profile itself has an application filter that must include the specific applications being used for the transfer.

How to eliminate wrong answers

Option B is wrong because the question states the security rule has the Data Filtering profile attached, so this is not the issue. Option C is wrong because logging of Data Filtering alerts is not required for the blocking action to occur; the profile will block regardless of logging settings. Option D is wrong because SSL decryption is not a prerequisite for Data Filtering to inspect traffic; Data Filtering can inspect unencrypted payloads, and if the traffic is encrypted, decryption would be needed, but the question does not indicate the traffic is encrypted, and the core issue is the application scope within the profile.

Practice this question →

9

MCQeasy

What is the primary benefit of using App-ID in a security policy instead of relying solely on port-based rules?

A.It increases firewall throughput.

B.It allows enforcement based on application identity, even if the application uses non-standard ports.

C.It reduces the number of security rules needed.

D.It limits traffic to HTTP and HTTPS only.

AnswerB

This is the core advantage of App-ID.

Why this answer

Option C is correct because App-ID identifies the actual application regardless of port, allowing policy enforcement based on application identity. Option A is wrong because App-ID does not simplify rule management by itself. Option B is wrong because performance may be marginally impacted.

Option D is wrong because App-ID is not only for HTTP traffic.

Practice this question →

10

Drag & Dropmedium

Drag and drop the steps to configure a URL filtering profile on a Palo Alto Networks firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

URL filtering profile involves categories, actions, policy attachment, SSL decryption, and testing.

Practice this question →

11

Multi-Selectmedium

Which TWO methods can be used to create a custom App-ID signature?

Select 2 answers

A.Using a Data Filtering profile.

B.Using a packet buffer override.

C.Using a URL Filtering profile.

D.Using a custom application signature with an attribute filter.

E.Using a custom application signature with a port match.

AnswersB, D

Packet buffer override lets you define custom content to identify an application.

Why this answer

Option B is correct because a packet buffer override is a method used to create a custom App-ID signature by capturing and analyzing the payload of a specific application's traffic. This allows the firewall to identify the application based on unique byte sequences or patterns in the packet payload, which is essential for applications that use non-standard ports or encryption.

Exam trap

The trap here is that candidates often confuse port-based identification with App-ID, thinking a port match can define a custom application, but App-ID is designed to identify applications by their behavior and content, not by port number.

Practice this question →

12

Multi-Selecteasy

Which TWO are capabilities of Content-ID? (Choose two.)

Select 2 answers

A.Blocking files by type (e.g., .exe, .pdf).

B.Identifying the application regardless of port.

C.Applying QoS policies to applications.

D.Preventing sensitive data from being transferred.

AnswersA, D

File blocking profile controls this.

Why this answer

Content-ID is a Palo Alto Networks technology that extends App-ID by inspecting the actual content of traffic. It includes a file blocking capability that can block files by type (e.g., .exe, .pdf) based on the file's signature, not just its extension, providing granular control over file transfers. This is a core feature of Content-ID for data filtering.

Exam trap

The trap here is that candidates often confuse App-ID's port-independent application identification with Content-ID's content inspection capabilities, leading them to incorrectly select option B as a Content-ID feature.

Practice this question →

13

MCQeasy

A company wants to block file uploads of PDFs to the internet via HTTP. Which Content-ID profile should be configured?

A.Vulnerability Protection Profile

B.URL Filtering Profile

C.File Blocking Profile

D.Virus Profile

AnswerC

File Blocking profiles can block specific file types in uploads.

Why this answer

Option C is correct because the File Blocking Profile is specifically designed to block file transfers based on file type, such as PDF, over protocols like HTTP. This profile uses Content-ID to inspect the file content and enforce blocking policies for uploads or downloads, making it the appropriate choice to prevent PDF uploads to the internet.

Exam trap

The trap here is that candidates often confuse File Blocking with URL Filtering or Antivirus, assuming that blocking a file type is handled by URL categories or malware scanning, when in fact it requires a dedicated Content-ID profile that inspects the file itself regardless of the URL or threat status.

How to eliminate wrong answers

Option A is wrong because Vulnerability Protection Profile is used to detect and block exploit attempts and malware delivery via vulnerabilities, not to block specific file types like PDFs. Option B is wrong because URL Filtering Profile controls access to websites based on URL categories and reputation, not file content or type. Option D is wrong because Virus Profile (antivirus) is designed to detect and block malware within files, but it does not block files based solely on their type (e.g., PDF) without a malicious signature.

Practice this question →

14

MCQhard

An organization uses App-ID to allow 'web-browsing' but notices that some web traffic is being blocked. The traffic is HTTP over port 8080. What is a likely cause?

A.The 'web-browsing' application does not include HTTP.

B.A custom application must be created for port 8080.

C.The security rule does not have Application set to 'web-browsing' for that traffic.

D.App-ID cannot identify HTTP over non-standard ports.

AnswerC

If the rule only allows web-browsing on port 80/443, it may not match port 8080.

Why this answer

Option C is correct because if the security rule does not have 'web-browsing' set as the Application, the firewall will not allow HTTP traffic even if the port (8080) is permitted. App-ID identifies the application regardless of port, but the security policy must explicitly allow the application for the traffic to pass. In this case, the traffic is being blocked because the rule either has a different application or no application specified, so the firewall drops it by default.

Exam trap

The trap here is that candidates often assume App-ID relies on port numbers and that non-standard ports require custom applications, but App-ID identifies applications by content, not port, so the issue is almost always the security rule's application setting.

How to eliminate wrong answers

Option A is wrong because the 'web-browsing' application does include HTTP; it is a built-in application that covers HTTP and HTTPS traffic. Option B is wrong because a custom application is not required for port 8080; App-ID can identify HTTP on any port, including 8080, using protocol decoders. Option D is wrong because App-ID can identify HTTP over non-standard ports; it uses protocol decoders and signatures, not just port numbers, to identify applications.

Practice this question →

15

MCQeasy

A company's security policy must allow Microsoft Teams traffic but deny all other chat applications. Which type of object should be specified in the 'Application' column of the security policy rule?

A.Application Filter with conditions matching Microsoft Teams.

B.Application object for Microsoft Teams.

C.Service object for Microsoft Teams' ports.

D.Application Group named 'Chat_Apps' containing all chat apps.

AnswerB

Directly specifying the application object allows only that app.

Why this answer

Option B is correct because the security policy rule's 'Application' column requires a specific application object to match traffic identified by App-ID. An application object for Microsoft Teams allows the firewall to identify and permit Teams traffic based on its unique application signatures, including its underlying protocols (e.g., HTTPS, STUN, TURN) and cloud endpoints, while blocking all other chat applications by default.

Exam trap

The trap here is that candidates often confuse application objects with service objects, thinking that port-based rules (e.g., allowing TCP 443) are sufficient to permit Microsoft Teams, but App-ID requires the application object to differentiate Teams from other HTTPS-based chat apps like Slack or WhatsApp Web.

How to eliminate wrong answers

Option A is wrong because an Application Filter is used to dynamically match a set of applications based on characteristics (e.g., category, technology, risk), not to allow a single specific application like Microsoft Teams; it would be too broad and could inadvertently permit other chat apps. Option C is wrong because a Service object matches traffic based on IP protocol and port numbers (e.g., TCP/UDP), but Microsoft Teams uses dynamic ports and multiple protocols (including HTTPS on port 443 and proprietary UDP ranges), so port-based matching cannot reliably distinguish Teams from other chat applications. Option D is wrong because an Application Group named 'Chat_Apps' containing all chat apps would allow all chat applications, violating the policy requirement to deny all chat apps except Microsoft Teams.

Practice this question →

16

MCQhard

During an App-ID upgrade, some applications are no longer identified correctly. What is the most likely cause?

A.The security rules were modified.

B.The application database was rolled back.

C.The firewall needs a reboot.

D.The custom application signatures were not migrated.

AnswerD

Custom signatures need to be re-imported or migrated after an upgrade.

Why this answer

During an App-ID upgrade, custom application signatures are stored separately from the built-in application database. If these custom signatures are not migrated to the new version, the firewall will lose the ability to identify those applications, even though the built-in App-ID database is updated. This is the most likely cause because the upgrade process does not automatically preserve user-defined objects.

Exam trap

Palo Alto Networks often tests the misconception that App-ID upgrades only affect built-in applications, leading candidates to overlook the need to migrate custom application signatures, which are not automatically carried over.

How to eliminate wrong answers

Option A is wrong because modifying security rules changes policy enforcement, not the underlying application identification logic; App-ID identification is independent of rule configuration. Option B is wrong because a rollback of the application database would revert to a previous version, not cause a failure to identify applications after an upgrade; the question states an upgrade occurred, not a rollback. Option C is wrong because a reboot does not affect the integrity or migration of custom application signatures; rebooting only restarts services and does not restore missing custom objects.

Practice this question →

17

Multi-Selecthard

Which THREE factors should be considered when troubleshooting App-ID misidentification? (Choose three.)

Select 3 answers

A.Packet size exceeds the maximum transmission unit.

B.An application override is configured that misidentifies the app.

C.Traffic is encrypted and decryption is not enabled.

D.Asymmetric routing is causing the firewall to see only one direction of traffic.

AnswersB, C, D

Override can force an incorrect identification.

Why this answer

Option B is correct because an application override explicitly forces the firewall to classify traffic as a specific application, bypassing App-ID's signature-based identification. If the override is misconfigured, the firewall will consistently misidentify the traffic, leading to incorrect policy enforcement. This is a common cause of App-ID misidentification when administrators manually override the default identification process.

Exam trap

The trap here is that candidates may think packet size or MTU issues affect App-ID, but App-ID operates at layers 4-7 and is not impacted by fragmentation; the real focus is on decryption, routing symmetry, and override configurations.

Practice this question →

18

MCQmedium

A network administrator notices that traffic for a custom business application is being incorrectly identified as 'ssl' by the firewall. What is the most efficient way to ensure this application is accurately identified without impacting other SSL traffic?

A.Disable App-ID for the security policy rule that allows this traffic.

B.Upgrade the App-ID database to the latest version.

C.Create an App-ID override for the application's specific IP addresses and ports.

D.Add the application's TCP port to the service definition in the security policy.

AnswerC

An App-ID override forces the firewall to identify the traffic as the specified application.

Why this answer

Option C is correct because an App-ID override allows you to manually assign a specific application signature to traffic matching defined IP addresses and ports, ensuring the custom business application is correctly identified without altering the global App-ID database or affecting other SSL traffic. This is the most efficient method as it directly overrides the incorrect identification at the application level, preserving the integrity of other SSL-based application detection.

Exam trap

The trap here is that candidates often confuse App-ID override with service definitions or disabling App-ID, thinking that changing port-based classification or updating signatures will fix custom application identification, when in fact only a direct application override provides precise control without collateral impact.

How to eliminate wrong answers

Option A is wrong because disabling App-ID for the security policy rule would cause the firewall to rely solely on IP addresses and ports for classification, potentially allowing malicious traffic to bypass application-level inspection and degrading security. Option B is wrong because upgrading the App-ID database updates signatures for known applications but cannot resolve misidentification of a custom application that lacks a predefined signature. Option D is wrong because adding the application's TCP port to the service definition only matches traffic based on port numbers, not application identity, and does not correct the App-ID misclassification; it may also inadvertently allow non-application traffic on that port.

Practice this question →

19

MCQmedium

A security engineer is troubleshooting why YouTube video streaming is not being identified as 'youtube-streaming' but instead as 'youtube-base'. What could be the reason?

A.The firewall has not received the latest App-ID update.

B.SSL decryption is not configured.

C.The traffic lacks enough signatures to identify the sub-application.

D.A security rule is blocking the sub-application.

AnswerC

If only partial identification is possible, it shows as the parent app.

Why this answer

Option C is correct because App-ID uses a multi-layered approach to identify applications, including signatures, SSL decryption, and behavioral analysis. When YouTube traffic is classified as 'youtube-base' instead of the more specific 'youtube-streaming', it indicates that the firewall has identified the base application (YouTube) but lacks sufficient signatures or heuristics to differentiate the streaming sub-application. This typically occurs when the traffic does not contain enough distinct patterns (e.g., specific HTTP headers, TLS SNI, or packet sizes) to trigger the sub-application signature.

Exam trap

The trap here is that candidates often assume SSL decryption is mandatory for sub-application identification, but App-ID can leverage unencrypted metadata (like SNI and DNS) to classify sub-applications without decryption, making option B a common distractor.

How to eliminate wrong answers

Option A is wrong because an outdated App-ID update would likely cause the firewall to fail to identify YouTube at all, not misclassify it as a base application; the base application signature is typically included in the same update. Option B is wrong because SSL decryption is not required for YouTube streaming identification; App-ID can use non-encrypted metadata (e.g., SNI, DNS, HTTP headers) to classify sub-applications, and YouTube streaming often uses unencrypted portions of the protocol. Option D is wrong because a security rule blocking the sub-application would prevent the traffic from being processed, not cause a misclassification; the firewall would still identify the sub-application correctly in the logs but then drop the session.

Practice this question →

20

Multi-Selectmedium

Which TWO statements are true regarding App-ID and Content-ID? (Choose two.)

Select 2 answers

A.Content-ID provides capabilities such as File Blocking, Data Filtering, and URL Filtering.

B.App-ID can identify applications regardless of the port or protocol used.

C.Content-ID only works for web traffic.

D.App-ID requires SSL decryption to identify encrypted applications.

E.Content-ID can function without App-ID enabled.

AnswersA, B

These are all part of Content-ID.

Why this answer

Options A and D are correct. Option A is true because App-ID identifies applications independently of ports. Option D is true because content-ID includes file blocking, data filtering, and URL filtering.

Option B is false because Content-ID depends on App-ID for application context. Option C is false because App-ID does not require SSL decryption; it can use other methods. Option E is false because Content-ID includes URL filtering, which is separate from App-ID.

Practice this question →

21

MCQmedium

A user reports that they cannot download PDF files from a corporate web application. The security policy has a File Blocking Profile applied to deny 'PDF' files. The web application uses 'ssl' and 'web-browsing' apps. What should the administrator verify first?

A.Ensure the security rule includes the application 'pdf-download' in the Application list.

B.Confirm that the File Blocking Profile is applied to the correct applications (ssl and web-browsing) in the security rule.

C.Check that the File Blocking Profile has 'PDF' selected under 'File Types to Block'.

D.Verify the URL Category of the web application is included in the rule.

AnswerB

File Blocking Profiles are enforced per application within a rule.

Why this answer

Option B is correct because File Blocking Profiles are applied per application in a security rule. The administrator must first verify that the profile is attached to the correct applications (ssl and web-browsing) that the web application uses; otherwise, the file blocking will not be enforced for those applications, even if the profile itself is configured correctly.

Exam trap

The trap here is that candidates often jump to checking the profile configuration (Option C) or URL categories (Option D) without first verifying that the File Blocking Profile is actually applied to the correct applications in the security rule, which is the most common misconfiguration.

How to eliminate wrong answers

Option A is wrong because 'pdf-download' is not a standard App-ID; file downloads are identified by the application used (e.g., web-browsing or ssl), not a separate 'pdf-download' app. Option C is wrong because while checking that 'PDF' is selected under 'File Types to Block' is important, it is not the first step; the profile must first be applied to the correct applications in the security rule for it to take effect. Option D is wrong because URL Category filtering is not directly related to file blocking; the issue is about file type blocking, not URL access control.

Practice this question →

22

MCQmedium

Refer to the exhibit. A user on the Trust zone is trying to download a file from an FTP server on the Untrust zone using FTP on TCP port 21. The firewall's security policy is as shown. What will happen?

A.The traffic is denied by the implicit deny rule at the end.

B.The traffic is allowed because 'Allow-Web' matches web-browsing over port 80 or 443.

C.The traffic is denied by the 'Block-FTP' rule.

D.The traffic is allowed because no rule explicitly blocks it.

AnswerC

The deny rule matches the FTP application.

Why this answer

The correct answer is C because the security policy explicitly includes a rule named 'Block-FTP' that denies FTP traffic. FTP uses TCP port 21 for control traffic, and the firewall matches this traffic against the policy rules in order. Since 'Block-FTP' matches the FTP application (or port 21) and denies it, the traffic is blocked before reaching any implicit deny rule.

Exam trap

The trap here is that candidates may assume traffic is allowed by default or only blocked by an implicit deny, overlooking the explicit 'Block-FTP' rule that matches before the implicit deny and specifically denies the FTP traffic.

How to eliminate wrong answers

Option A is wrong because the traffic is not denied by the implicit deny rule; it is denied earlier by the explicit 'Block-FTP' rule, which matches before the implicit deny is evaluated. Option B is wrong because 'Allow-Web' only permits web-browsing traffic on ports 80 or 443 (HTTP/HTTPS), not FTP on port 21, so it does not apply. Option D is wrong because there is an explicit rule ('Block-FTP') that blocks the traffic, contradicting the claim that no rule explicitly blocks it.

Practice this question →

23

MCQmedium

Refer to the exhibit. An administrator notes that traffic to Facebook is being denied. What is the most likely reason?

A.SSL decryption is not configured.

B.The profile group is blocking Facebook.

C.The rule order is incorrect.

D.Facebook is not in the allowed applications list.

AnswerD

The rule only allows web-browsing and ssl; Facebook is a different application.

Why this answer

The exhibit shows a security policy rule with an 'allowed applications' list that does not include Facebook. Since App-ID identifies Facebook traffic by its application signature, any traffic matching this rule will be denied unless Facebook is explicitly allowed. Option D is correct because the absence of Facebook in the allowed applications list causes the firewall to block the traffic.

Exam trap

Palo Alto Networks often tests the misconception that SSL decryption is necessary to identify or control encrypted applications, but App-ID can identify many encrypted applications using non-decryption methods like SNI and JA3.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not required to block or allow Facebook; App-ID can identify Facebook traffic even when encrypted, using techniques like Server Name Indication (SNI) and JA3 fingerprinting. Option B is wrong because a profile group (e.g., for URL filtering or threat prevention) does not block applications; it applies security profiles to allowed traffic, but the application must first be permitted by the security rule. Option C is wrong because rule order affects which rule is matched first, but if the rule that matches the traffic does not include Facebook in its allowed applications list, the traffic will be denied regardless of its position in the rulebase.

Practice this question →

24

MCQmedium

A user reports that they are unable to download executable files from the internet. The firewall security rule allows the application. What should the administrator check first?

A.The SSL decryption policy.

B.The vulnerability protection profile.

C.The file blocking profile for the rule.

D.The URL filtering category for 'executables'.

AnswerC

A file blocking profile set to block 'exe' would prevent downloads.

Why this answer

The user cannot download executable files, which is a specific file type. The file blocking profile is the Content-ID feature that controls file transfer based on type, regardless of the application being allowed. Since the security rule permits the application, the administrator should first check the file blocking profile attached to that rule to see if it blocks 'executable' files.

Exam trap

The trap here is that candidates confuse file blocking with URL filtering or application control, assuming that allowing the application automatically permits all file transfers, but Content-ID file blocking operates independently at the file level.

How to eliminate wrong answers

Option A is wrong because SSL decryption policy controls whether encrypted traffic is decrypted for inspection, not the blocking of specific file types like executables. Option B is wrong because vulnerability protection profiles detect and prevent exploit attempts, not file type transfers. Option D is wrong because URL filtering categories classify web pages by content (e.g., 'malware', 'hacking'), not by file extension or MIME type; there is no URL filtering category named 'executables'.

Practice this question →

25

Multi-Selectmedium

Which TWO statements about App-ID are correct? (Choose two.)

Select 2 answers

A.App-ID can identify applications even if they use standard ports for other services.

B.App-ID is only effective for well-known commercial applications.

C.App-ID primarily identifies applications based on port numbers.

D.App-ID uses signatures to identify known applications.

E.App-ID requires at least 10 packets to identify an application.

AnswersA, D

App-ID decodes traffic regardless of port.

Why this answer

Option A is correct because App-ID uses multiple identification mechanisms—including application signatures, SSL/TLS fingerprinting, and behavioral analysis—to identify applications regardless of the port they use. This means an application like SSH running on TCP 443 (typically used for HTTPS) will still be correctly identified as SSH, not as web-browsing traffic.

Exam trap

Palo Alto Networks often tests the misconception that App-ID relies on port numbers, tempting candidates to select option C, but the correct understanding is that App-ID is port-agnostic and uses multiple deeper inspection methods.

Practice this question →

26

MCQhard

A security engineer wants to block downloading of executable files over HTTP and HTTPS, but allow all other web traffic. Which Content-ID feature should be configured to achieve this granular control?

A.Use an Application Override to identify executables.

B.Create a Data Filtering Profile to block executable file types.

C.Configure a URL Filtering Profile to block executables.

D.Set up a File Blocking Profile and apply it to the security rule for web-browsing.

AnswerD

File Blocking blocks files by type within allowed applications.

Why this answer

Option D is correct because a File Blocking Profile is specifically designed to block the transfer of files based on file type (e.g., PE executables) over any allowed application, such as web-browsing. By applying this profile to a security rule that permits HTTP and HTTPS traffic, you can block executable downloads while allowing all other web content. This leverages Content-ID's file-type identification, which inspects the actual file content (magic bytes) rather than relying on extensions or application signatures.

Exam trap

The trap here is that candidates often confuse Data Filtering (which blocks data patterns) with File Blocking (which blocks file types), or mistakenly think URL Filtering can block specific file downloads, when in fact URL Filtering only controls access to URLs/categories, not the content of the files transferred.

How to eliminate wrong answers

Option A is wrong because an Application Override is used to force traffic to be identified as a specific application, not to block file types; it would not inspect or block executable files within allowed web traffic. Option B is wrong because a Data Filtering Profile is designed to block sensitive data patterns (e.g., credit card numbers) or enforce data size limits, not to block specific file types like executables. Option C is wrong because a URL Filtering Profile controls access to websites based on URL categories (e.g., malware, phishing), not the content of files downloaded from those sites; it cannot block executable files within allowed HTTP/HTTPS traffic.

Practice this question →

27

MCQhard

During a security audit, it is discovered that some users are bypassing the company's web proxy by using HTTPS to external websites. The firewall is configured to allow 'web-browsing' application. What is the best way to enforce proxy usage for all HTTP/HTTPS traffic?

A.Enable SSL decryption and block traffic that is not decrypted.

B.Create a security rule that denies 'web-browsing' from users to the internet, and a separate rule allowing only the proxy server to use web-browsing.

C.Configure Content-ID to block all web traffic.

D.Use URL filtering to block all URLs except those from the proxy.

AnswerB

This ensures users must go through the proxy.

Why this answer

Option A is correct because by blocking the 'web-browsing' application directly, users cannot bypass the proxy; only the proxy server should be allowed to use web-browsing. Option B is wrong because SSL decryption does not enforce proxy usage. Option C is wrong because URL filtering can block categories but does not enforce proxy.

Option D is wrong because App-ID and Content-ID work together, but the key is to control the application.

Practice this question →

28

MCQhard

An organization uses a custom ERP system that communicates over TCP port 4444. The firewall's App-ID incorrectly identifies some of the traffic as 'ssl' because the ERP system uses a proprietary encryption wrapper. What is the recommended approach to ensure correct identification?

A.Use Application Override to force the ERP application for all traffic on port 4444.

B.Enable SSL decryption to inspect the encrypted traffic.

C.Create a custom App-ID that matches the proprietary encryption wrapper signature.

D.Add a security rule that allows the ERP application object without further configuration.

AnswerC

Custom App-ID signatures can identify applications based on payload patterns.

Why this answer

Option C is correct because when App-ID misclassifies traffic due to a proprietary encryption wrapper, the recommended approach is to create a custom App-ID that matches the specific signature of that wrapper. This allows the firewall to correctly identify the application without relying on port-based heuristics or decryption, preserving the integrity of the encrypted session while ensuring accurate policy enforcement.

Exam trap

The trap here is that candidates often confuse Application Override (which disables App-ID) with a custom App-ID (which enhances App-ID), leading them to choose Option A as a quick fix instead of the more precise and correct solution of creating a custom signature.

How to eliminate wrong answers

Option A is wrong because Application Override bypasses App-ID entirely, forcing all traffic on port 4444 to be treated as the specified application, which can mask other legitimate or malicious traffic on that port and is not a precise solution for misclassification. Option B is wrong because enabling SSL decryption would require the firewall to decrypt the proprietary encryption wrapper, which may not be possible if the wrapper is not standard SSL/TLS, and it introduces unnecessary overhead and privacy concerns. Option D is wrong because simply allowing the ERP application object without further configuration does not address the root cause of misidentification; the firewall will still incorrectly classify the traffic as 'ssl' and the rule may not match as intended.

Practice this question →

29

MCQmedium

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. The application uses a proprietary protocol on TCP port 8080. What is the most efficient way to ensure correct identification without disabling App-ID?

A.Use Application Override with the custom application and specify port 8080.

B.Create a custom App-ID signature for the proprietary protocol.

C.Disable App-ID for that security rule to allow all traffic on port 8080.

D.Create a custom service object for TCP 8080 and add it to a security policy.

AnswerB

Custom App-ID signatures enable accurate identification of non-standard applications.

Why this answer

Option B is correct because creating a custom App-ID signature allows the firewall to correctly identify the proprietary protocol by its unique traffic patterns, such as packet payload signatures or behavioral characteristics, without disabling App-ID. This is the most efficient method as it leverages App-ID's existing classification engine to distinguish the custom application from web-browsing, even though it uses TCP port 8080.

Exam trap

The trap here is that candidates often confuse Application Override (which bypasses App-ID) with a custom App-ID signature (which enhances App-ID), leading them to choose option A because it seems simpler, but it actually disables deep inspection and security controls.

How to eliminate wrong answers

Option A is wrong because Application Override bypasses App-ID entirely, forcing the firewall to trust the port-based classification and disabling all security features like IPS and URL filtering for that traffic, which is not the goal. Option C is wrong because disabling App-ID for the security rule would allow all traffic on port 8080 without any application identification, defeating the purpose of correct identification and exposing the network to threats. Option D is wrong because creating a custom service object for TCP 8080 only defines the port in the security policy but does not change how App-ID classifies the traffic; the firewall would still incorrectly identify the proprietary protocol as web-browsing.

Practice this question →

30

MCQeasy

Refer to the exhibit. An administrator sees this output and notices that App-ID is not identifying applications. What is the most likely cause?

A.The security rules are misconfigured.

B.The firewall needs a license for App-ID.

C.App-ID is disabled.

D.The application database is not yet loaded.

AnswerD

'init' indicates the database is loading; until complete, applications won't be identified.

Why this answer

The output shows that App-ID is not identifying applications, which typically occurs when the application database has not finished loading after a reboot or initial startup. During this period, the firewall cannot perform application-based classification, so all traffic is treated as unknown until the database is fully loaded. This is a known behavior in PAN-OS, where the application database loads asynchronously after the system boots.

Exam trap

The trap here is that candidates often assume App-ID requires a separate license or that it can be disabled globally, when in fact the most common cause of App-ID not identifying applications after a reboot is the application database not yet being loaded.

How to eliminate wrong answers

Option A is wrong because security rules control traffic flow based on existing classifications, but they do not prevent App-ID from identifying applications; misconfigured rules would block or allow traffic, not disable App-ID detection. Option B is wrong because App-ID does not require a separate license; it is a core feature included with the base firewall subscription, unlike Threat Prevention or URL Filtering which require licenses. Option C is wrong because App-ID is enabled by default and cannot be globally disabled; individual security rules can disable App-ID per rule, but the output indicates a system-wide issue, not a per-rule setting.

Practice this question →

31

MCQhard

An administrator is troubleshooting why an application is being identified as 'incomplete' in the traffic log. What does this indicate?

A.The application is using a non-standard port.

B.The session was terminated before App-ID could complete.

C.The firewall could not determine the application.

D.The application is unknown to the firewall.

AnswerB

Short-lived sessions may end before App-ID finishes analysis.

Why this answer

When App-ID cannot complete its analysis before the session terminates, the traffic log marks the application as 'incomplete'. This typically happens with short-lived sessions or when the firewall receives insufficient data packets to match a signature or decode the protocol. The correct answer is B because App-ID requires multiple packets or a full handshake to definitively identify the application.

Exam trap

The trap here is confusing 'incomplete' with 'unknown' or 'not-applicable', where candidates incorrectly think the firewall simply cannot identify the application, rather than understanding that the session ended before App-ID finished processing.

How to eliminate wrong answers

Option A is wrong because using a non-standard port does not cause an 'incomplete' status; App-ID can still identify applications on non-standard ports via protocol decoders and behavioral signatures. Option C is wrong because 'incomplete' specifically means App-ID was still processing when the session ended, not that it failed to determine the application (which would be 'unknown' or 'not-applicable'). Option D is wrong because 'unknown' is a separate status indicating the application is not in the App-ID database, whereas 'incomplete' means the identification process was interrupted.

Practice this question →

32

Multi-Selecteasy

Which TWO are methods used by App-ID to identify applications? (Choose two.)

Select 2 answers

A.URL filtering

B.Source port number

C.Source IP address

D.Pattern matching (signatures)

E.Protocol decoding

AnswersD, E

App-ID uses signatures to match application payloads.

Why this answer

Option D is correct because App-ID uses pattern matching (signatures) to identify applications by analyzing the unique byte sequences or payload patterns within network traffic. These signatures are derived from the application's protocol behavior and can detect applications even when they use non-standard ports or encryption.

Exam trap

The trap here is that candidates often confuse App-ID with port-based or IP-based identification, mistakenly thinking that source port or IP address are used to identify applications, when in fact App-ID relies on protocol decoding and signature matching to determine the actual application regardless of port or address.

Practice this question →

33

MCQmedium

A network security engineer at a large enterprise is troubleshooting an issue where web traffic (HTTP and HTTPS) from the corporate LAN to the internet is being incorrectly classified by the Palo Alto Networks firewall. The firewall is running PAN-OS 10.2. The security policy has an App-ID based rule that allows 'web-browsing' and 'ssl' applications to the internet. However, legitimate web traffic is being blocked by a different rule that denies 'unknown-tcp' traffic. The engineer has verified that the firewall has internet connectivity and that the SSL decryption is not configured. The engineer also confirmed that the application override is not configured for any of the affected IPs. What is the most likely reason for the misclassification, and what action should the engineer take to resolve the issue?

A.Configure User-ID and enable User-ID mapping for the web traffic.

B.Review the App-ID logs for the traffic to see if the application is being identified as 'incomplete' or 'not-applicable', and ensure the firewall can successfully decode the traffic. If needed, enable SSL decryption or update the SSL/TLS certificate chain on the firewall.

C.Disable all application security profiles for the affected traffic to allow the firewall to classify based on port only.

D.Create custom App-ID signatures for the web servers.

AnswerB

App-ID may fail to decode the traffic if the SSL handshake fails or the certificate is not trusted. This leads to 'unknown-tcp' classification. Enabling SSL decryption or ensuring proper certificate chains can resolve this.

Why this answer

Option B is correct because the firewall's App-ID relies on decoding the initial packets of a session to identify the application. Without SSL decryption, HTTPS traffic appears as encrypted payload, which App-ID cannot decode, often resulting in classification as 'ssl' (if the handshake is recognized) or 'unknown-tcp' if the handshake is incomplete or not fully parsed. The engineer should review the App-ID logs for 'incomplete' or 'not-applicable' status, and enabling SSL decryption or updating the certificate chain would allow the firewall to inspect the encrypted traffic and correctly identify it as 'web-browsing' or 'ssl'.

Exam trap

The trap here is that candidates assume App-ID can always identify HTTPS traffic as 'ssl' without decryption, but they overlook that incomplete handshakes or missing initial packets cause the firewall to classify the traffic as 'unknown-tcp', leading to incorrect rule matches.

How to eliminate wrong answers

Option A is wrong because User-ID is used for mapping users to IP addresses for policy enforcement based on user identity, not for correcting application misclassification; the issue is App-ID, not User-ID. Option C is wrong because disabling application security profiles would not change the App-ID classification; it would only remove threat prevention, and the firewall would still classify traffic based on App-ID, not port, so the 'unknown-tcp' denial would persist. Option D is wrong because creating custom App-ID signatures is unnecessary for standard web traffic (HTTP/HTTPS) and would be an overly complex workaround; the root cause is the lack of SSL decryption preventing proper decoding of encrypted sessions.

Practice this question →

34

Multi-Selecteasy

Which two components are part of Content-ID? (Choose two.)

Select 2 answers

A.Application Override

B.File Blocking

C.Data Filtering

D.URL Filtering

AnswersB, C

File blocking is a Content-ID feature.

Why this answer

File Blocking (option B) is a core component of Content-ID that allows administrators to block or allow specific file types based on MIME type or file extension, regardless of the application or port used. Data Filtering (option C) is also part of Content-ID and enables inspection of data patterns (e.g., credit card numbers, SSNs) within application traffic to prevent data exfiltration. Both features operate after App-ID identifies the application, providing granular control over content within allowed sessions.

Exam trap

The trap here is that candidates often confuse App-ID components (like Application Override) with Content-ID components, or mistakenly think URL Filtering is part of Content-ID when it is actually a separate subscription-based feature for web categorization.

Practice this question →

35

MCQeasy

Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?

A.URL Filtering

B.File Blocking

C.Data Filtering

D.WildFire

AnswerC

Data Filtering can block specific content patterns like SSNs.

Why this answer

Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.

Exam trap

The trap here is that candidates often confuse Data Filtering with File Blocking, assuming that blocking file transfers is the primary DLP mechanism, when in fact Data Filtering is the dedicated feature for pattern-based content inspection within allowed traffic.

How to eliminate wrong answers

Option A is wrong because URL Filtering controls access to websites based on categories and URLs, not by inspecting the content of traffic for specific patterns to prevent data loss. Option B is wrong because File Blocking blocks file transfers based on file type (e.g., .exe, .pdf) or direction, but it does not scan the content of files or data streams for sensitive patterns. Option D is wrong because WildFire is a threat analysis service for unknown malware and exploits, not a feature for blocking specific data patterns to prevent data loss.

Practice this question →

36

MCQmedium

A medium-sized enterprise has deployed a Palo Alto Networks firewall in a branch office. They use App-ID to control access to cloud applications. Recently, they migrated from on-premises Exchange to Office 365. They have a security rule that allows 'office365-base' for all users. However, users report that they cannot access their Office 365 email via Outlook client, although web access works fine. The firewall logs show that the traffic is being allowed as 'office365-base' but no other Office 365 sub-applications are seen. The IT team suspects that App-ID is not fully identifying the Outlook client traffic. What should they do to resolve this issue?

A.Enable SSL decryption to allow App-ID to identify the Outlook traffic.

B.Modify the existing rule to allow 'office365-base' and other Office 365 sub-applications like 'office365-outlook' and 'office365-exchange'.

C.Create a new rule that allows 'outlook' application specifically.

D.Change the rule to allow 'office365-base' and set Action to 'allow' with a QoS policy.

AnswerB

Allowing the base app alone is insufficient for full functionality.

Why this answer

Option B is correct because the 'office365-base' App-ID only provides basic identification for Office 365 traffic, but Outlook client traffic requires more specific sub-applications like 'office365-outlook' and 'office365-exchange' to be explicitly allowed in the security rule. Without these sub-applications, the firewall may allow the traffic as 'office365-base' but fail to fully identify and permit the Outlook client's proprietary protocols, such as MAPI over HTTP or RPC over HTTPS, which are necessary for email functionality.

Exam trap

The trap here is that candidates assume 'office365-base' covers all Office 365 traffic, but the PCNSA exam tests the understanding that sub-applications must be explicitly allowed for specific client applications like Outlook to function correctly.

How to eliminate wrong answers

Option A is wrong because enabling SSL decryption is not required for App-ID to identify Outlook traffic; App-ID can identify Office 365 applications using metadata and other heuristics without decrypting SSL, and SSL decryption introduces additional overhead and privacy concerns. Option C is wrong because there is no standalone 'outlook' application in Palo Alto Networks App-ID; Outlook traffic is identified as part of the Office 365 application suite, specifically as sub-applications like 'office365-outlook' and 'office365-exchange'. Option D is wrong because changing the rule to allow 'office365-base' with a QoS policy does not address the root cause—the rule still lacks the necessary sub-applications to identify Outlook client traffic, and QoS only manages bandwidth, not application identification.

Practice this question →

37

MCQeasy

Which of the following is a primary benefit of using App-ID in a security policy?

A.It enforces policies based on the actual application, irrespective of port or encryption.

B.It allows blocking traffic based on port numbers only.

C.It only works for known applications.

D.It can only be applied to outbound traffic.

AnswerA

That is the core benefit of App-ID.

Why this answer

App-ID is a core Palo Alto Networks technology that identifies traffic based on application signatures, not just port or protocol. This allows security policies to enforce rules based on the actual application (e.g., Facebook, Salesforce) even if it uses non-standard ports or is encrypted via SSL/TLS. The primary benefit is decoupling application identification from port, enabling granular control over application usage regardless of how the application is disguised.

Exam trap

The trap here is that candidates often assume App-ID is just another port-based firewall feature, but the exam tests the understanding that App-ID identifies applications regardless of port or encryption, making it a fundamental shift from traditional port-based security policies.

How to eliminate wrong answers

Option B is wrong because App-ID does not rely on port numbers; it identifies applications by their unique signatures, behavior, and decryption, making port-based blocking a legacy and ineffective approach. Option C is wrong because App-ID can identify unknown or custom applications using behavioral analysis and heuristics, not just known applications from the application database. Option D is wrong because App-ID can be applied to both inbound and outbound traffic, as security policies are bidirectional and App-ID inspects all traffic flows.

Practice this question →

38

MCQmedium

A company has a security policy that allows 'ssl' application but does not have SSL decryption enabled. What can App-ID still identify from the encrypted session?

A.The SNI (Server Name Indication).

B.The exact URL being accessed.

C.The file type being transferred.

D.The client and server IP addresses.

AnswerA

SNI is transmitted in cleartext and can help identify the intended server.

Why this answer

App-ID can identify the SNI (Server Name Indication) from an encrypted session because the SNI is sent in cleartext during the TLS handshake, before encryption begins. This allows the firewall to determine the destination hostname without decrypting the traffic, enabling policy enforcement based on the application or domain even when SSL decryption is disabled.

Exam trap

The trap here is that candidates assume all encrypted traffic is opaque to App-ID, but the SNI field remains visible and can be used for application identification, which is a key distinction tested in the PCNSA exam.

How to eliminate wrong answers

Option B is wrong because the exact URL (including path and query parameters) is encrypted within the TLS tunnel and cannot be inspected without SSL decryption. Option C is wrong because the file type being transferred is determined by inspecting the payload after decryption or via protocol decoding, which is not possible in an encrypted session. Option D is wrong because while client and server IP addresses are visible in the packet headers, they are not identified by App-ID; App-ID focuses on application-level identification, not network-layer addressing.

Practice this question →

39

Matchingmedium

Match each security zone type to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

External, low trust zone

Internal, high trust zone

Public-facing servers, medium trust

Transparent zone for inline deployments

Why these pairings

These are typical zone types in a Palo Alto firewall.

Practice this question →

40

Multi-Selecthard

Which TWO are required for accurate application identification when an application uses non-standard ports?

Select 2 answers

A.Define a custom service for the port.

B.Enable App-ID.

C.Use a Content-ID profile.

D.Create a custom application signature.

E.Disable SSL Decryption.

AnswersB, D

App-ID must be enabled to perform application identification.

Why this answer

App-ID is the core technology that identifies applications regardless of port, using signatures, protocol decoders, and behavioral analysis. When an application uses non-standard ports, App-ID must be enabled to inspect traffic beyond simple port-based classification, ensuring accurate identification even if the application is not using its default port.

Exam trap

The trap here is that candidates often think defining a custom service for the port is sufficient for identification, but App-ID requires either its built-in signatures or a custom application signature to accurately identify applications on non-standard ports.

Practice this question →

41

MCQmedium

An administrator wants to block all peer-to-peer file sharing traffic, but must ensure that legitimate business applications like FTP are not affected. Which approach is most effective?

A.Create an Application Filter that matches all P2P applications and use it in a deny rule.

B.Create a security rule with 'application none' and block the common P2P ports.

C.Use a Service object to block all ports typically used by P2P applications.

D.Identify each known P2P application and add them individually to a block rule.

AnswerA

Application filters dynamically match a category of applications.

Why this answer

Option A is correct because Palo Alto Networks App-ID can identify peer-to-peer (P2P) traffic by application signature, regardless of port. Creating an Application Filter that matches all P2P applications (e.g., BitTorrent, eDonkey, Gnutella) and applying it in a deny rule ensures all P2P traffic is blocked while legitimate business applications like FTP (which uses distinct App-ID signatures) are not affected, as App-ID decodes traffic at Layer 7.

Exam trap

The trap here is that candidates often assume port-based blocking (Options B and C) is sufficient, but App-ID is designed to decouple application identity from port, making port-based rules ineffective against modern P2P traffic that uses port evasion techniques.

How to eliminate wrong answers

Option B is wrong because using 'application none' with port blocking is ineffective—P2P applications often use non-standard ports or port hopping, and 'application none' would not match traffic that App-ID identifies as a known application, potentially allowing P2P traffic on allowed ports. Option C is wrong because blocking common P2P ports (e.g., 6881-6889 for BitTorrent) is easily bypassed by P2P applications that use random or HTTP/HTTPS ports, and it would also block legitimate applications using those ports. Option D is wrong because individually adding each known P2P application to a block rule is impractical—new P2P variants emerge frequently, and this approach would miss unknown or custom P2P applications, leaving gaps in coverage.

Practice this question →

42

MCQeasy

A security administrator notices that traffic from a custom application is being incorrectly identified as web-browsing. What is the most likely cause?

A.The application signature database is outdated.

B.App-ID is disabled on the security rule.

C.The custom application uses HTTP but no specific App-ID signature.

D.Content-ID is blocking the application.

AnswerC

Without a custom signature, App-ID may classify the traffic as web-browsing.

Why this answer

Option C is correct because when a custom application uses HTTP but lacks a specific App-ID signature, Palo Alto Networks firewalls default to classifying the traffic as web-browsing (HTTP). App-ID relies on a combination of protocol decoders and application signatures; without a custom App-ID signature defined for the application, the firewall cannot distinguish it from generic HTTP traffic.

Exam trap

Palo Alto Networks often tests the misconception that an outdated signature database is the root cause, but the trap here is that the custom application has no signature at all, so updating the database would not help—the administrator must create a custom App-ID signature or use an application override.

How to eliminate wrong answers

Option A is wrong because an outdated signature database would affect the identification of known applications, but the issue here is that the custom application has no specific signature at all, not that the signature is stale. Option B is wrong because if App-ID were disabled on the security rule, the firewall would not perform any application identification, and traffic would be classified based on port or IP, not incorrectly identified as web-browsing. Option D is wrong because Content-ID is a separate feature that handles URL filtering, file blocking, and data filtering; it does not affect how traffic is initially identified by App-ID.

Practice this question →

43

Multi-Selecteasy

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Select 2 answers

A.Create a security rule with the application and action 'deny'.

B.Block the common ports used by the application.

C.Disable App-ID on the zone to prevent inspection.

D.Create a security rule allowing the application but with a limit.

E.Use an Application Override to categorize the traffic and then block it.

AnswersA, E

Denying the application blocks all its traffic.

Why this answer

Option A is correct because App-ID identifies traffic based on application signatures, not just ports. By creating a security rule with the specific application and setting the action to 'deny', the firewall blocks all traffic matching that application regardless of the ports or protocols it uses. This is the most precise and effective method to block an application that uses multiple ports.

Exam trap

The trap here is that candidates mistakenly think blocking common ports (Option B) is sufficient, but the exam tests the understanding that App-ID is application-aware and port-independent, making application-based blocking the correct approach.

Practice this question →

44

MCQhard

Refer to the exhibit. A user reports being unable to connect to a website over HTTPS. The traffic log shows the application as 'incomplete' and the rule 'Block-Unknown-App' is matched. What is the most likely reason the application is 'incomplete'?

A.The security rule is misconfigured because it lacks an application field.

B.App-ID has not yet completed identification because the session is new or requires more packets.

C.The firewall does not have an App-ID signature for the website.

D.SSL decryption is not enabled, so App-ID cannot identify HTTPS traffic.

AnswerB

For encrypted traffic, App-ID may need multiple packets to identify the application; until then it shows 'incomplete'.

Why this answer

When a firewall logs an application as 'incomplete', it means App-ID has not yet finished identifying the application for that session. This typically occurs for new sessions or when the firewall needs to see more packets (e.g., the SSL/TLS handshake or additional data) to match a signature. Since the session matched a rule that blocks unknown applications, the firewall is correctly enforcing the policy while App-ID is still in progress.

Exam trap

Palo Alto Networks often tests the distinction between 'incomplete' (App-ID still processing) and 'unknown' (App-ID could not identify the application), so the trap here is assuming 'incomplete' means the firewall lacks a signature or that SSL decryption is mandatory for HTTPS identification.

How to eliminate wrong answers

Option A is wrong because the rule does have an application field (it matches 'unknown-app'), so the misconfiguration is not about a missing application field. Option C is wrong because 'incomplete' does not mean the firewall lacks a signature; it means the identification process is still ongoing, not that the signature is absent. Option D is wrong because SSL decryption is not required for App-ID to identify HTTPS traffic; App-ID can identify many HTTPS applications using metadata such as SNI, JA3 fingerprints, or IP addresses without decrypting the traffic.

Practice this question →

45

MCQhard

Refer to the exhibit. An administrator wants to block all traffic that does not match a specific application (e.g., only allow 'web-browsing'). What should be done?

A.Use a file blocking profile.

B.Change application to ['unknown-tcp', 'unknown-udp'].

C.Change category to ['misccategory'].

D.Change action to 'deny' and create a new rule with application ['web-browsing'] above it.

AnswerD

A deny-all rule at the bottom with specific allow rules above is best practice.

Why this answer

Option D is correct because to enforce an allow-list approach for a specific application like 'web-browsing', you must first create a rule that denies all traffic (action 'deny') and then place a higher-priority rule above it that explicitly allows only 'web-browsing'. This ensures that any traffic not matching the allowed application is blocked by the default-deny rule, leveraging App-ID's ability to identify applications regardless of port or protocol.

Exam trap

Palo Alto Networks often tests the misconception that you can block all non-matching traffic by simply changing the action of the existing rule to 'deny' without adding a separate allow rule above it, but that would block everything including the desired application.

How to eliminate wrong answers

Option A is wrong because file blocking profiles are used to block specific file types (e.g., executables, PDFs) within allowed application traffic, not to block entire applications or non-matching traffic. Option B is wrong because changing the application to ['unknown-tcp', 'unknown-udp'] would only match traffic that App-ID cannot identify, not block all non-'web-browsing' traffic; it would also allow unknown traffic that might be malicious. Option C is wrong because changing the category to ['misccategory'] would only match traffic categorized as miscellaneous, which is a subset of unknown or uncategorized traffic, not a comprehensive block for all non-'web-browsing' applications.

Practice this question →

46

MCQhard

During a security audit, it is discovered that FTP traffic over non-standard ports is bypassing App-ID inspection. What is the most effective method to ensure all FTP traffic is identified, regardless of port?

A.Update the App-ID and threat databases to the latest version.

B.Set the security policy to 'allow' without App-ID to ensure FTP works.

C.Add the non-standard port to the FTP service definition.

D.Create an Application Override rule for FTP on the required source and destination addresses.

AnswerD

Application Override forces App-ID to treat the traffic as FTP.

Why this answer

Option A is correct because an Application Override for FTP can be configured to identify FTP traffic on any port by specifying the application and source/destination. Option B is wrong because disabling App-ID removes inspection. Option C is wrong because updating App-ID database does not change detection behavior for custom ports.

Option D is wrong because Service definitions are port-based, not application-based.

Practice this question →

47

Multi-Selecthard

Which THREE actions are valid when configuring App-ID in a security policy? (Choose three.)

Select 3 answers

A.Reset-Client

B.Deny

C.Apply

D.Allow

E.Decrypt

AnswersA, B, D

Reset-Client sends a TCP reset to the client, a valid action.

Why this answer

A is correct because 'Reset-Client' is a valid action in App-ID security policy rules that terminates the client session by sending a TCP reset (RST) packet. This action is used to block traffic while providing immediate feedback to the client that the connection was refused, rather than silently dropping packets.

Exam trap

The trap here is confusing security policy actions with decryption policy actions, leading candidates to incorrectly select 'Decrypt' as a valid App-ID action when it belongs to a separate policy type.

Practice this question →

48

MCQhard

A global company uses a Palo Alto Networks firewall at its headquarters. They have a security policy that allows 'web-browsing' and 'ssl' for all users. Recently, they deployed a new custom web application for internal use that runs on TCP port 8443 with SSL. The application is not identified by App-ID as 'web-browsing' or 'ssl', but as 'unknown-tcp'. The security team wants to ensure that only this specific application is allowed, and all other unknown traffic is blocked. They have created a custom App-ID for the application using application override. However, after applying the override, the traffic is still shown as 'unknown-tcp' in logs. What is the most likely reason?

A.SSL decryption is not enabled for the custom application.

B.The custom application needs to be added to the 'ssl' application group.

C.The security rule that allows the traffic does not include the custom application.

D.The application override was not committed.

AnswerC

The traffic may be matching a different rule that doesn't have the custom app.

Why this answer

Option C is correct because the security rule that allows 'web-browsing' and 'ssl' does not automatically permit the custom application. Even though an application override was created to identify the custom application on TCP 8443, the security policy must explicitly include that custom application in the rule's 'Application' field. Without that, the firewall still matches the traffic against the existing rule, which only allows 'web-browsing' and 'ssl', so the traffic is denied and logged as 'unknown-tcp'.

Exam trap

The trap here is that candidates assume an application override alone will make the traffic match an existing rule that allows 'ssl' or 'web-browsing', but the override creates a new App-ID that must be explicitly added to the security rule's application list.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not required for application override to work; application override identifies the application based on port and IP, not decryption. Option B is wrong because adding the custom application to the 'ssl' application group would not change its App-ID; the override already assigns a custom App-ID, and groups do not affect identification. Option D is wrong because if the override were not committed, the traffic would still be identified as 'unknown-tcp', but the question states the override was applied; the most likely reason is the security rule missing the custom application, not a commit issue.

Practice this question →

49

MCQhard

A security team notices that custom application 'myapp' is not being identified by App-ID even though the correct application override is in place. What should they verify first?

A.Ensure the application uses a standard port.

B.Ensure SSL decryption is enabled for the application.

C.Check if the application override is applied to the correct rule.

D.Verify that the traffic reaches the firewall and is allowed by a security policy rule that has App-ID enabled.

AnswerD

If traffic is blocked by an earlier rule, App-ID never processes it.

Why this answer

Option D is correct because App-ID identification occurs after the firewall receives traffic and matches a security policy rule. Even with a correct application override, the traffic must first be allowed by a security policy rule that has App-ID enabled; otherwise, the override is never evaluated. The override only applies to the application identification process, not to the policy enforcement layer.

Exam trap

The trap here is that candidates assume an application override is a standalone fix that works regardless of the security policy rule's App-ID setting, when in fact the override is only evaluated if the rule has App-ID enabled and the traffic matches that rule.

How to eliminate wrong answers

Option A is wrong because App-ID is designed to identify applications regardless of port, and application overrides do not require a standard port; in fact, many custom applications use non-standard ports. Option B is wrong because SSL decryption is only needed if the application traffic is encrypted and you want to inspect the payload, but the application override itself does not require decryption to be enabled. Option C is wrong because the application override is a configuration object that maps a custom application to a specific signature or port, and while it must be applied to a rule, the first verification step is to confirm the traffic is actually hitting a security policy rule with App-ID enabled, not just that the override is attached to any rule.

Practice this question →

50

MCQhard

An administrator configures a custom App-ID signature using a packet buffer override. What is the implication?

A.The custom signature will only match on specific ports.

B.The custom signature will be ignored if it conflicts with built-in.

C.The custom signature requires a separate license.

D.The firewall will use the custom signature instead of the default.

AnswerD

Packet buffer override replaces the built-in signature for that application.

Why this answer

When a custom App-ID signature is configured with a packet buffer override, the firewall is instructed to use the custom signature's definition to identify the application instead of relying on the default built-in App-ID signature. This override ensures that the custom signature takes precedence over any existing default signature for the same application, allowing the administrator to enforce a specific application identification behavior.

Exam trap

The trap here is that candidates mistakenly think a packet buffer override only affects port-based matching or that custom signatures are always subordinate to built-in signatures, when in fact the override explicitly gives the custom signature priority.

How to eliminate wrong answers

Option A is wrong because a packet buffer override does not restrict matching to specific ports; App-ID signatures can match on content regardless of port, and the override only affects which signature is used. Option B is wrong because the packet buffer override is specifically designed to resolve conflicts by making the custom signature take precedence over the built-in one, not to be ignored. Option C is wrong because custom App-ID signatures do not require a separate license; they are a standard feature of the App-ID engine available in the base firewall subscription.

Practice this question →

51

MCQeasy

A company wants to block all traffic from the application 'facebook-base' but allow 'facebook-chat'. Which type of security rule is most appropriate?

A.Application filter in security policy

B.File Blocking profile

C.URL Filtering profile

D.Security rule with 'facebook-base' as deny and 'facebook-chat' as allow

AnswerA

Application filters allow precise allow/deny for specific applications.

Why this answer

Option A is correct because an Application filter in a security policy allows you to specify which applications are allowed or denied based on the App-ID. By creating a rule that denies 'facebook-base' while allowing 'facebook-chat', you can precisely control traffic at the application layer, even when both applications share the same underlying protocol (e.g., TCP/443). This granularity is a core feature of App-ID, enabling you to block the broader Facebook base application while permitting the specific chat sub-application.

Exam trap

The trap here is that candidates often think a single security rule can have mixed actions (deny and allow) for different applications, but in Palo Alto Networks, you must use an application filter to achieve this granularity, as a security rule applies a single action to all matched traffic.

How to eliminate wrong answers

Option B is wrong because a File Blocking profile is used to block specific file types (e.g., executables, archives) within allowed application traffic, not to control application access itself. Option C is wrong because a URL Filtering profile controls access based on URLs or categories (e.g., social-networking), not individual applications like 'facebook-base' or 'facebook-chat', and cannot differentiate between sub-applications within the same base app. Option D is wrong because a security rule cannot simultaneously deny and allow the same application; it applies a single action (allow or deny) per rule, and you cannot mix actions for sub-applications within one rule without using an application filter.

Practice this question →

52

Multi-Selectmedium

Which TWO of the following are true about App-ID? (Choose two.)

Select 2 answers

A.App-ID cannot identify custom applications.

B.App-ID identifies applications regardless of port.

C.App-ID uses signatures, protocol decoding, and behavioral analysis to identify applications.

D.App-ID can only identify applications on standard ports.

AnswersB, C

It is port-agnostic.

Why this answer

App-ID is designed to identify applications based on their unique traffic behavior, not just port numbers. By using signatures, protocol decoding, and behavioral analysis, App-ID can accurately detect applications even when they are running on non-standard ports, such as SSH on TCP 2222 or HTTP on TCP 8080. This decoupling from port-based identification is a core strength of the Palo Alto Networks next-generation firewall.

Exam trap

The trap here is that candidates often assume App-ID relies on port numbers for identification, similar to traditional firewalls, but the exam tests the understanding that App-ID is port-agnostic and uses deep packet inspection to identify applications regardless of the port used.

Practice this question →

53

MCQmedium

A medium-sized enterprise has a Palo Alto Networks firewall in your data center. They have recently deployed a new cloud-based CRM system that uses a proprietary protocol over TCP port 8443. The firewall is configured with App-ID enabled, but traffic to the CRM is being incorrectly identified as 'web-browsing' and 'ssl'. Users are able to access the CRM, but the security team wants to ensure that only authorized users can use this application. They have created a custom App-ID signature based on a unique payload pattern in the first packet. However, after applying the signature and committing, the traffic logs still show the application as 'incomplete' or 'web-browsing'. The firewall is running PAN-OS 10.1. What is the most likely reason the custom App-ID is not working?

A.The firewall needs to have Application Override enabled for the custom signature to work.

B.The firewall must be restarted to apply the new custom signature.

C.The existing sessions are still using the old identification; new sessions must be initiated to see the correct application.

D.The signature must be imported from the Palo Alto Networks application database.

AnswerC

App-ID updates identification for new sessions; existing sessions continue with previous identification.

Why this answer

Option C is correct because App-ID identification occurs at session setup. Once a session is established, the application is determined from the first few packets. If the custom App-ID signature was applied after sessions to the CRM were already active, those existing sessions will continue to show the previously identified application (e.g., 'web-browsing' or 'ssl') until they expire.

Only new sessions will trigger the new signature and display the correct custom application. This is a fundamental behavior of Palo Alto Networks' session-based architecture.

Exam trap

The trap here is that candidates assume a commit immediately updates all traffic, but Palo Alto Networks firewalls only apply App-ID changes to new sessions, not existing ones.

How to eliminate wrong answers

Option A is wrong because Application Override is used to force a specific application for all traffic on a given port, bypassing App-ID entirely; it is not required for a custom App-ID signature to work. Option B is wrong because Palo Alto Networks firewalls do not require a restart to apply new custom App-ID signatures; a commit is sufficient to activate them. Option D is wrong because custom App-ID signatures are created locally by the administrator and do not need to be imported from the Palo Alto Networks application database; that database is for predefined applications.

Practice this question →

54

MCQmedium

A network administrator observes that a user is able to access a cloud storage application even though a security rule explicitly blocks that application. Other application blocks work correctly. What is the most likely cause?

A.The user is accessing the application over HTTPS on a common web port, and App-ID cannot correctly identify the application.

B.The security rule order is incorrect; a previous rule allows the application.

C.URL filtering is misconfigured and allowing the URL for the cloud storage.

D.A Content-ID profile is overriding the application block.

AnswerA

App-ID may misidentify the traffic as generic web-browsing if it cannot discern the specific application.

Why this answer

App-ID relies on multiple identification mechanisms, including protocol decoding, application signatures, and SSL decryption. When a cloud storage application is accessed over HTTPS on a common web port (e.g., 443), App-ID may fail to correctly identify the application if the traffic is encrypted and no SSL decryption policy is applied, or if the application uses a technique like 'port hopping' or 'tunneling over HTTP/HTTPS'. This causes the security rule explicitly blocking the application to be ineffective, as the traffic is instead matched against a different application signature (e.g., 'web-browsing') that is allowed.

Exam trap

The trap here is that candidates assume a security rule blocking an application will always work, but they overlook the fact that App-ID must first correctly identify the application—especially when traffic is encrypted over standard ports—and that without SSL decryption, the firewall may see only 'web-browsing' or 'ssl' instead of the specific cloud storage app.

How to eliminate wrong answers

Option B is wrong because security rules are evaluated in order from top to bottom, and if a previous rule allowed the application, the explicit block rule would never be reached; however, the question states 'other application blocks work correctly,' implying the rule order is not the issue. Option C is wrong because URL filtering is a separate feature that controls access based on URL categories, not application identity; even if a URL is allowed, the application block rule should still block the application if App-ID correctly identifies it. Option D is wrong because Content-ID profiles (e.g., antivirus, vulnerability protection) do not override application blocks; they apply additional security actions after App-ID has already identified the application, and they cannot permit a blocked application.

Practice this question →

55

Multi-Selecteasy

Which THREE Content-ID components typically require a separate license or subscription?

Select 3 answers

A.SSL Decryption

B.File Blocking

C.WildFire

D.URL Filtering (PAN-DB)

E.Data Filtering

AnswersA, C, D

SSL Decryption requires a separate license.

Why this answer

SSL Decryption requires a separate license because it involves intercepting and inspecting encrypted traffic, which demands dedicated cryptographic processing resources and legal compliance frameworks. Without a valid SSL Decryption license, the firewall cannot decrypt HTTPS traffic to apply Content-ID inspection, limiting visibility into encrypted threats.

Exam trap

The trap here is that candidates often assume File Blocking or Data Filtering require separate licenses because they sound like premium features, but Palo Alto Networks bundles them into the base Threat Prevention subscription, while SSL Decryption, WildFire, and URL Filtering are explicitly licensed add-ons.

Practice this question →

56

MCQeasy

What is the primary benefit of using Content-ID in a security policy?

A.It blocks malicious URLs.

B.It prioritizes traffic for specific applications.

C.It enables threat prevention and file blocking on allowed applications.

D.It identifies applications regardless of port.

AnswerC

Content-ID inspects content after App-ID allows the application.

Why this answer

Content-ID is the component of Palo Alto Networks' next-generation firewall that performs deep packet inspection on allowed application traffic. It enables threat prevention (e.g., antivirus, anti-spyware, vulnerability protection) and file blocking (e.g., blocking specific file types like .exe or .pdf) by scanning the content within the application sessions that have been identified by App-ID. Without Content-ID, the firewall would only allow or deny traffic based on application identity, but would not inspect the payload for threats or enforce file-based controls.

Exam trap

Palo Alto Networks often tests the distinction between App-ID (application identification) and Content-ID (content inspection), and the trap here is confusing Content-ID with URL filtering or QoS, leading candidates to pick options that describe functions of other features.

How to eliminate wrong answers

Option A is wrong because blocking malicious URLs is the function of URL Filtering, not Content-ID; Content-ID inspects the content of allowed application traffic, not the URL. Option B is wrong because prioritizing traffic for specific applications is the function of QoS (Quality of Service) policies, which can be based on App-ID, but Content-ID does not handle traffic prioritization. Option D is wrong because identifying applications regardless of port is the primary function of App-ID, which uses protocol decoders and signatures to identify applications, not Content-ID.

Practice this question →

57

MCQmedium

An administrator wants to block upload of files with extension .exe to the application 'box-net'. Which security policy component is most appropriate?

A.Data Filtering profile

B.Application filter in security rule

C.URL Filtering profile

D.File Blocking profile

AnswerD

File Blocking profiles block specific file types for given applications.

Why this answer

The File Blocking profile is the correct choice because it is specifically designed to block files based on type (e.g., .exe) within allowed applications like 'box-net'. This profile works with App-ID to enforce content-level control, preventing the upload of executable files while still permitting the application's traffic.

Exam trap

The trap here is that candidates often confuse File Blocking with Data Filtering, but Data Filtering is for data patterns (e.g., SSNs), not file types, while File Blocking specifically targets file extensions and types.

How to eliminate wrong answers

Option A is wrong because Data Filtering profile controls the transfer of sensitive data patterns (e.g., credit card numbers) via predefined or custom signatures, not file extensions. Option B is wrong because an Application filter in a security rule controls which applications are allowed or denied, not the specific file types within an allowed application. Option C is wrong because URL Filtering profile manages access to websites based on URL categories, not file upload restrictions within an application.

Practice this question →

58

MCQmedium

What is the most likely reason the traffic is being denied?

A.The application is not actually matching the rule.

B.A threat prevention profile is blocking the application due to its 'evasive-behavior' characteristic.

C.A DoS protection policy is blocking the traffic.

D.App-ID is incorrectly identifying the traffic.

AnswerB

Evasive applications are often blocked by default profiles.

Why this answer

Option B is correct because the question describes a scenario where traffic is denied despite the application being identified by App-ID. A threat prevention profile can block applications that exhibit 'evasive-behavior' characteristics, such as using non-standard ports or encryption to evade detection. This is a common security control in Palo Alto Networks firewalls to prevent malicious or evasive applications from bypassing policy.

Exam trap

The trap here is that candidates often assume traffic is denied due to a misconfiguration of App-ID or a DoS policy, but the key clue is the 'evasive-behavior' characteristic, which directly points to a threat prevention profile action.

How to eliminate wrong answers

Option A is wrong because if the application were not matching the rule, the traffic would likely be allowed or denied by a default rule, not specifically blocked due to an application characteristic. Option C is wrong because a DoS protection policy blocks traffic based on rate limits or session thresholds, not based on the application's evasive behavior. Option D is wrong because App-ID is correctly identifying the traffic (as implied by the question), but the threat prevention profile is blocking it due to its evasive-behavior characteristic, not because of misidentification.

Practice this question →

59

MCQmedium

Which of the following is a prerequisite for App-ID to identify applications in encrypted traffic?

A.Configure a custom application signature.

B.Enable SSL decryption.

C.Ensure the security rule allows the application.

D.Enable App-ID on the security rule.

AnswerB

SSL decryption is required to inspect encrypted traffic for application identification.

Why this answer

App-ID identifies applications by analyzing traffic patterns, including those in encrypted flows. However, to inspect the content of encrypted traffic (e.g., HTTPS), the firewall must first decrypt it using SSL decryption. Without decryption, App-ID can only rely on metadata like IP addresses and ports, which is insufficient for accurate identification of many modern applications that use encryption.

Exam trap

The trap here is that candidates often assume App-ID can identify all applications purely from metadata or signatures without needing decryption, but the exam tests that SSL decryption is a prerequisite for accurate identification of applications in encrypted traffic.

How to eliminate wrong answers

Option A is wrong because configuring a custom application signature is not a prerequisite for App-ID to identify applications in encrypted traffic; custom signatures are used for proprietary or non-standard applications, but App-ID can still identify many encrypted applications via other methods (e.g., JA3 fingerprinting) without custom signatures. Option C is wrong because ensuring the security rule allows the application is a consequence of identification, not a prerequisite; the rule must first be configured to allow traffic, but App-ID identification happens before rule matching. Option D is wrong because enabling App-ID on the security rule is a configuration step to activate App-ID processing, but it does not enable decryption; without SSL decryption, App-ID cannot see the encrypted payload to identify the application.

Practice this question →

60

MCQeasy

A small business owner wants to block all social media applications during work hours for employees. The firewall is configured with App-ID and has a security rule that denies the 'social-networking' application category from the internal zone to the internet zone. The rule is placed at the top of the security policy. However, employees are still able to access Facebook and Twitter. The traffic logs show these applications are being allowed by a different rule. The administrator checks the security policy and finds the deny rule for social-networking is present but not matched. What is the most likely reason the deny rule is not being matched?

A.There is a rule above the deny rule that allows all traffic.

B.The source IP address range does not include the employees' subnet.

C.The source zone is set to 'any' but the actual traffic is coming from a different zone than assumed.

D.The security rule does not have a URL Filtering profile attached.

AnswerC

If the source zone is misconfigured, the rule will not match traffic from the correct zone.

Why this answer

Option C is correct because the security rule's source zone is set to 'any' but the actual traffic originates from a different zone than the administrator assumed. App-ID rules match based on zone membership, and if the employees' traffic is coming from a zone not included in the rule's source zone (e.g., a guest or VPN zone), the rule will not match, allowing the traffic to be evaluated by subsequent rules. The traffic logs confirm the traffic is allowed by a different rule, indicating the deny rule is being bypassed due to zone mismatch.

Exam trap

Palo Alto Networks often tests the misconception that App-ID rules match solely on application category without considering zone or other match criteria, leading candidates to overlook zone misconfiguration as the root cause.

How to eliminate wrong answers

Option A is wrong because if a rule above the deny rule allowed all traffic, the deny rule would never be reached, but the question states the deny rule is present but not matched, implying it is evaluated but fails to match; a rule allowing all traffic would still be matched, not cause the deny rule to be unmatched. Option B is wrong because the source IP address range not including the employees' subnet would cause the rule to not match, but the question specifies the rule is placed at the top and the traffic logs show the applications are allowed by a different rule, indicating the issue is zone-based, not IP-based; App-ID rules match on zone first, then IP, so a zone mismatch is more likely. Option D is wrong because URL Filtering profiles are used for URL-based blocking, not for blocking applications via App-ID; App-ID identifies applications by their traffic patterns and signatures, and a security rule denying the 'social-networking' category does not require a URL Filtering profile to match or block the application.

Practice this question →

Ready to test yourself?

Try a timed practice session using only App-ID and Content-ID questions.

Start 20-question session