How should I use these Securing Traffic and App-ID practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Securing Traffic and App-ID questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Securing Traffic and App-ID domain.

PCNSE · topic practice

Securing Traffic and App-ID practice questions

Practise Palo Alto Networks Certified Network Security Engineer PCNSE Securing Traffic and App-ID practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Securing Traffic and App-ID

Practice 10 questions Browse domain →

What the exam tests

What to know about Securing Traffic and App-ID

Securing Traffic and App-ID questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Securing Traffic and App-ID exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Securing Traffic and App-ID questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Securing Traffic and App-ID explanation →

A security engineer notices that traffic from a trusted internal application is being blocked by the firewall. The application communicates using a proprietary protocol over TCP port 8443. The engineer has already created a custom App-ID for this application but the traffic is still being blocked. What is the most likely reason?

Trap 1: The custom App-ID must be added to a security profile group.

Security profile groups are for threat prevention, not for App-ID assignment.

Trap 2: The custom App-ID needs a vulnerability profile to be activated.

Vulnerability profiles are separate and not required for App-ID activation.

Trap 3: The security policy rule uses the destination port instead of…

Security policies typically use App-ID, but the issue is that the custom App-ID is not being applied.

Study all Securing Traffic and App-ID common traps →

A
The custom App-ID must be added to a security profile group.
Why wrong: Security profile groups are for threat prevention, not for App-ID assignment.
B
The custom App-ID needs a vulnerability profile to be activated.
Why wrong: Vulnerability profiles are separate and not required for App-ID activation.
C
The security policy rule uses the destination port instead of App-ID.
Why wrong: Security policies typically use App-ID, but the issue is that the custom App-ID is not being applied.
D
An application override rule must be configured to associate the custom App-ID with the traffic.
Application override is necessary to bypass signature-based identification and assign the custom App-ID.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Securing Traffic and App-ID explanation →

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

Trap 1: SSL decryption must be enabled for the firewall to correctly…

SSL decryption is not required; App-ID can identify SSL traffic without decryption.

Trap 2: The default interzone rule is blocking the SSL identification…

Interzone rules affect forwarding, not App-ID identification.

Trap 3: The security policy allows 'web-browsing' before 'ssl' in the rule…

Rule order affects policy matching, not App-ID identification.

Study all Securing Traffic and App-ID common traps →

A
SSL decryption must be enabled for the firewall to correctly identify SSL traffic.
Why wrong: SSL decryption is not required; App-ID can identify SSL traffic without decryption.
B
The firewall is not seeing the full SSL handshake due to asymmetric routing.
Asymmetric routing can prevent the firewall from seeing the SSL handshake, causing it to identify the traffic as HTTP.
C
The default interzone rule is blocking the SSL identification packets.
Why wrong: Interzone rules affect forwarding, not App-ID identification.
D
The security policy allows 'web-browsing' before 'ssl' in the rule order.
Why wrong: Rule order affects policy matching, not App-ID identification.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Securing Traffic and App-ID explanation →

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

Trap 1: Create a security rule with destination port 80 and 443 and action…

This would allow all HTTP/HTTPS traffic, not just specific applications.

Trap 2: Create a security profile that blocks all applications not in the…

Security profiles apply threats, not application control.

Trap 3: Create a URL filtering rule to allow 'social-networking' and…

URL filtering controls web access, not application identification.

Study all Securing Traffic and App-ID common traps →

A
Create a security rule with application conditions set to 'facebook-base' and 'youtube' and action set to 'allow'.
This rule allows only the specified applications.
B
Create a security rule with destination port 80 and 443 and action set to 'allow'.
Why wrong: This would allow all HTTP/HTTPS traffic, not just specific applications.
C
Create a security profile that blocks all applications not in the allow list.
Why wrong: Security profiles apply threats, not application control.
D
Create a URL filtering rule to allow 'social-networking' and 'multimedia' categories.
Why wrong: URL filtering controls web access, not application identification.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Securing Traffic and App-ID explanation →

A company deploys a Palo Alto Networks firewall in a data center. They have a critical application that uses a proprietary protocol over UDP port 12345. The firewall is not correctly identifying the traffic as the custom App-ID they created. They have verified that the custom App-ID is correctly configured and committed. What is the most likely cause?

Trap 1: The firewall must be rebooted for the custom App-ID to take effect.

Committing the configuration is sufficient; reboot is not required.

Trap 2: The custom App-ID must be enabled in the 'Applications' section of…

Custom App-IDs are enabled by default once configured.

Trap 3: The firewall cannot identify applications over UDP.

App-ID supports UDP application identification.

Study all Securing Traffic and App-ID common traps →

A
The firewall must be rebooted for the custom App-ID to take effect.
Why wrong: Committing the configuration is sufficient; reboot is not required.
B
An application override rule has not been configured to associate the traffic with the custom App-ID.
Application override is required to bypass signature-based identification and assign the custom App-ID.
C
The custom App-ID must be enabled in the 'Applications' section of the firewall settings.
Why wrong: Custom App-IDs are enabled by default once configured.
D
The firewall cannot identify applications over UDP.
Why wrong: App-ID supports UDP application identification.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Securing Traffic and App-ID explanation →

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

Trap 1: Confirm that the source and destination users are correctly…

User-ID is not required for application-based rules.

Trap 2: Ensure that a security profile is applied to the rule to allow the…

Security profiles do not affect whether a rule allows traffic.

Trap 3: Check if the rule is placed after a deny-all rule.

Rule order is important but the rule should be placed appropriately.

Study all Securing Traffic and App-ID common traps →

A
Confirm that the source and destination users are correctly configured.
Why wrong: User-ID is not required for application-based rules.
B
Ensure that a security profile is applied to the rule to allow the application.
Why wrong: Security profiles do not affect whether a rule allows traffic.
C
Check if the rule is placed after a deny-all rule.
Why wrong: Rule order is important but the rule should be placed appropriately.
D
Verify that the firewall is correctly identifying the traffic as 'ms-update' using App-ID.
If the traffic is not identified as 'ms-update', the rule will not match.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Securing Traffic and App-ID explanation →

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Trap 1: Right-clicking on a session in the Traffic log and selecting…

This option is available for application override, not custom App-ID creation.

Trap 2: Using the 'Application Command Center' to automatically generate…

ACC is for monitoring, not creation.

Trap 3: Importing an App-ID definition file from a CSV.

There is no CSV import for App-IDs.

Study all Securing Traffic and App-ID common traps →

A
Right-clicking on a session in the Traffic log and selecting 'Create App-ID'.
Why wrong: This option is available for application override, not custom App-ID creation.
B
Using the 'Application Command Center' to automatically generate custom App-IDs.
Why wrong: ACC is for monitoring, not creation.
C
Using the 'set application' command in the CLI.
CLI allows configuration of custom applications.
D
Importing an App-ID definition file from a CSV.
Why wrong: There is no CSV import for App-IDs.
E
Using the 'Objects' > 'Application Filters' menu in the web interface.
This is the standard method to create custom App-IDs.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Securing Traffic and App-ID explanation →

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Trap 1: Multiple security rules are configured for the same traffic.

Multiple rules do not affect App-ID identification.

Trap 2: Traffic is forwarded through an HTTP proxy.

HTTP proxies can be handled by App-ID.

Study all Securing Traffic and App-ID common traps →

A
Multiple security rules are configured for the same traffic.
Why wrong: Multiple rules do not affect App-ID identification.
B
Asymmetric routing causes the firewall to see only one direction of traffic.
Asymmetric routing can prevent the firewall from seeing the full session, causing inaccurate identification.
C
SSL decryption is not enabled for the traffic.
Without decryption, App-ID cannot inspect encrypted payloads, leading to potential incorrect identification.
D
IP fragmentation occurs before the firewall.
Fragmentation can obscure application signatures, leading to misidentification.
E
Traffic is forwarded through an HTTP proxy.
Why wrong: HTTP proxies can be handled by App-ID.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Securing Traffic and App-ID explanation →

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Exhibit

Refer to the exhibit.

admin@PA-220> show system info | match appid
appid version: 8000-7120
appid last update: 2024/10/01 03:00:00
appid packet buffer: 1024 KB
appid max sessions: 500000

Trap 1: App-ID can only handle 1024 KB of packet data per session.

The buffer is shared, not per session.

Trap 2: The firewall logs the first 1024 KB of every session for App-ID.

The buffer is for analysis, not logging.

Trap 3: The firewall offloads App-ID processing to a dedicated buffer of…

There is no offloading; the buffer is on the firewall.

Study all Securing Traffic and App-ID common traps →

A
App-ID can only handle 1024 KB of packet data per session.
Why wrong: The buffer is shared, not per session.
B
The firewall can buffer up to 1024 KB of packet data for App-ID analysis.
This buffer stores packets for deep inspection when needed.
C
The firewall logs the first 1024 KB of every session for App-ID.
Why wrong: The buffer is for analysis, not logging.
D
The firewall offloads App-ID processing to a dedicated buffer of 1024 KB.
Why wrong: There is no offloading; the buffer is on the firewall.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Securing Traffic and App-ID explanation →

Refer to the exhibit. A network engineer wants to allow only 'ms-update' and 'facebook-base' traffic. After committing the above security policy, they find that 'ssl' traffic is also being allowed. What is the most likely reason?

Exhibit

Refer to the exhibit.

admin@PA-220> show running security-policy | match app
rule id 1: application any -> allow
rule id 2: application ms-update, facebook-base -> allow
rule id 3: application ssl, web-browsing -> allow
rule id 4: application any -> deny

Trap 1: App-ID is not enabled on the firewall.

If App-ID were disabled, no application would be identified.

Trap 2: Rule 4 is a deny rule but it is not effective because the traffic…

Rule 4 is after rule 1, but rule 1 allows the traffic.

Trap 3: The rule order is incorrect; rule 3 should be moved before rule 1.

Moving rule 3 would not fix the issue because rule 1 allows all applications.

Study all Securing Traffic and App-ID common traps →

A
Rule 1 allows all applications because it uses 'application any'.
Rule 1 matches all applications before the more specific rules, causing all traffic to be allowed.
B
App-ID is not enabled on the firewall.
Why wrong: If App-ID were disabled, no application would be identified.
C
Rule 4 is a deny rule but it is not effective because the traffic is allowed earlier.
Why wrong: Rule 4 is after rule 1, but rule 1 allows the traffic.
D
The rule order is incorrect; rule 3 should be moved before rule 1.
Why wrong: Moving rule 3 would not fix the issue because rule 1 allows all applications.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Securing Traffic and App-ID explanation →

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Trap 1: The traffic is allowed by a security policy rule.

Allowing traffic in a security policy does not affect App-ID's ability to identify the application.

Trap 2: An application override policy is configured for the traffic.

An application override explicitly bypasses App-ID, so this would not cause App-ID to fail; it would prevent App-ID from being applied.

Trap 3: The firewall is using port-based application identification.

Port-based identification is not used by Palo Alto Networks; App-ID uses signatures and behavioral analysis.

Study all Securing Traffic and App-ID common traps →

A
The traffic is allowed by a security policy rule.
Why wrong: Allowing traffic in a security policy does not affect App-ID's ability to identify the application.
B
An application override policy is configured for the traffic.
Why wrong: An application override explicitly bypasses App-ID, so this would not cause App-ID to fail; it would prevent App-ID from being applied.
C
SSL decryption is not enabled for the traffic.
Without SSL decryption, App-ID cannot inspect encrypted traffic, leading to incorrect or failed identification.
D
The application is not in the Palo Alto Networks application database.
If the application is not in the database, App-ID cannot identify it, resulting in unknown traffic.
E
The firewall is using port-based application identification.
Why wrong: Port-based identification is not used by Palo Alto Networks; App-ID uses signatures and behavioral analysis.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Securing Traffic and App-ID explanation →

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

Exhibit

Refer to the exhibit.

show system state | match appid
total appid sessions: 12000
appid pending sessions: 4500
appid complete sessions: 7500
appid error sessions: 0

Trap 1: An application override policy is being used extensively.

Application override bypasses App-ID, so it would not increase pending sessions.

Trap 2: SSL decryption is disabled for most traffic.

Disabling decryption reduces the amount of traffic that App-ID needs to inspect, decreasing pending sessions.

Trap 3: The application database is outdated and missing signatures.

Missing signatures would likely cause error sessions, not pending sessions.

Study all Securing Traffic and App-ID common traps →

A
An application override policy is being used extensively.
Why wrong: Application override bypasses App-ID, so it would not increase pending sessions.
B
Security policy rules are not optimized, causing excessive traffic to be processed by App-ID.
Poorly designed security policies can cause unnecessary traffic to be inspected, leading to a high number of pending sessions.
C
SSL decryption is disabled for most traffic.
Why wrong: Disabling decryption reduces the amount of traffic that App-ID needs to inspect, decreasing pending sessions.
D
The application database is outdated and missing signatures.
Why wrong: Missing signatures would likely cause error sessions, not pending sessions.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Securing Traffic and App-ID explanation →

A company uses App-ID to identify traffic on their Palo Alto Networks firewall. They notice that a particular application, custom-db-sync, is not being identified correctly. The traffic uses a proprietary protocol over TCP port 4444. The firewall currently has a security rule allowing any application on that port. Which step should the engineer take to enable App-ID to correctly identify custom-db-sync?

Trap 1: Enable unknown application identification in the security rule.

Unknown application identification identifies unknown applications, not custom ones.

Trap 2: Use the default application override for port 4444 to allow traffic.

Application override bypasses App-ID and is not a solution for identifying applications.

Trap 3: Change the security rule to use 'application-default' as the…

Application-default maps to default ports but does not help with custom application identification.

Study all Securing Traffic and App-ID common traps →

A
Create a custom App-ID for custom-db-sync using the Application Object and define the appropriate signatures.
Custom App-IDs allow identification of proprietary protocols by defining signatures.
B
Enable unknown application identification in the security rule.
Why wrong: Unknown application identification identifies unknown applications, not custom ones.
C
Use the default application override for port 4444 to allow traffic.
Why wrong: Application override bypasses App-ID and is not a solution for identifying applications.
D
Change the security rule to use 'application-default' as the service to rely on port-based identification.
Why wrong: Application-default maps to default ports but does not help with custom application identification.

Full breakdown with real-world context →

Question 13hardmulti select

Read the full NAT/PAT explanation →

A network engineer is troubleshooting an issue where a web application is being incorrectly identified as 'web-browsing' instead of 'webmail-gmail' by the Palo Alto Networks firewall. The firewall has App-ID enabled and all signatures are up to date. Which TWO actions should the engineer take to resolve this misidentification?

Trap 1: Disable unknown application identification to force stricter…

Disabling unknown app identification does not correct misidentification of known apps.

Trap 2: Create a custom App-ID for webmail-gmail with stricter signatures.

Custom App-ID is unnecessary since webmail-gmail is already a known application.

Trap 3: Increase the application identification timeout to allow more time…

Timeout adjustment does not address signature matching issues.

Study all Securing Traffic and App-ID common traps →

A
Disable unknown application identification to force stricter matching.
Why wrong: Disabling unknown app identification does not correct misidentification of known apps.
B
Create a custom App-ID for webmail-gmail with stricter signatures.
Why wrong: Custom App-ID is unnecessary since webmail-gmail is already a known application.
C
Review the session log to see if the application changed during the session.
Session logs show App-ID updates; the application may have been re-identified later.
D
Increase the application identification timeout to allow more time for identification.
Why wrong: Timeout adjustment does not address signature matching issues.
E
Enable packet capture on the security rule to collect traffic for analysis.
PCAP allows analyzing traffic to see why the wrong signature matched.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full Securing Traffic and App-ID explanation →

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediumdrag order

Read the full Securing Traffic and App-ID explanation →

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediummatching

Read the full Securing Traffic and App-ID explanation →

Match each PAN-OS component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Handles configuration, logging, and reporting

Processes traffic and enforces security policies

Manages routing and session setup

Collects and stores logs for analysis

Centralized management for multiple firewalls

Question 17mediummatching

Read the full Securing Traffic and App-ID explanation →

Match each decryption type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Decrypts outbound traffic to inspect it

Decrypts inbound traffic to servers

Decrypts SSH traffic for policy enforcement

Traffic bypasses decryption

Sends decrypted traffic to a monitoring tool

Question 18easymultiple choice

Read the full Securing Traffic and App-ID explanation →

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

Trap 1: Create a new application group.

An application group is used to group existing applications, not to define a new one.

Trap 2: Create a new custom application tag.

Tags are for categorization and do not define the application itself.

Trap 3: Create a new application filter.

Application filters are used to dynamically select applications based on attributes, not to define a new application.

Study all Securing Traffic and App-ID common traps →

A
Create a new application and define the default port.
Correct: Creating the application object with its default port is the foundational step.
B
Create a new application group.
Why wrong: An application group is used to group existing applications, not to define a new one.
C
Create a new custom application tag.
Why wrong: Tags are for categorization and do not define the application itself.
D
Create a new application filter.
Why wrong: Application filters are used to dynamically select applications based on attributes, not to define a new application.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Securing Traffic and App-ID explanation →

An engineer wants to block all peer-to-peer file sharing traffic using App-ID. What security policy action should be used?

Trap 1: Drop.

Drop also blocks, but is less preferred because it does not send a reset, potentially causing timeouts.

Trap 2: Reset-both.

Reset-both is a specific type of deny that resets both sides; while it works, 'deny' is the standard recommended action.

Trap 3: Allow with antivirus profile.

Allowing the traffic would permit it, not block it.

Study all Securing Traffic and App-ID common traps →

A
Drop.
Why wrong: Drop also blocks, but is less preferred because it does not send a reset, potentially causing timeouts.
B
Reset-both.
Why wrong: Reset-both is a specific type of deny that resets both sides; while it works, 'deny' is the standard recommended action.
C
Allow with antivirus profile.
Why wrong: Allowing the traffic would permit it, not block it.
D
Deny.
Correct: Deny blocks the traffic and sends a TCP reset.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full NAT/PAT explanation →

A network engineer notices that traffic from an internal user to a web application is being incorrectly identified as 'web-browsing' instead of the custom application 'my-app'. The engineer has already created a custom application 'my-app' with the correct signature. What is the most likely reason for the misidentification?

Trap 1: The custom application is not activated in the security policy rule.

Security policy rules use the identified application; they do not affect the identification process itself.

Trap 2: The vulnerability protection profile is dropping the traffic.

Vulnerability protection profiles inspect traffic after identification and would not cause misidentification.

Trap 3: The decryption policy is blocking the traffic.

Decryption policy affects whether traffic is decrypted, not the initial identification via App-ID.

Study all Securing Traffic and App-ID common traps →

A
The custom application is not activated in the security policy rule.
Why wrong: Security policy rules use the identified application; they do not affect the identification process itself.
B
The application override is not configured.
Correct: Application override forces the firewall to identify traffic using the custom application's signature, overriding the default identification.
C
The vulnerability protection profile is dropping the traffic.
Why wrong: Vulnerability protection profiles inspect traffic after identification and would not cause misidentification.
D
The decryption policy is blocking the traffic.
Why wrong: Decryption policy affects whether traffic is decrypted, not the initial identification via App-ID.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Securing Traffic and App-ID sessions

Start a Securing Traffic and App-ID only practice session

Every question in these sessions is drawn from the Securing Traffic and App-ID domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Securing Traffic and App-ID questions →Mixed PCNSE session

Frequently asked questions

What does the PCNSE exam test about Securing Traffic and App-ID?: Securing Traffic and App-ID questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Securing Traffic and App-ID questions in a focused session?: Yes — the session launcher on this page draws every question from the Securing Traffic and App-ID domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNSE topics?: Use the topic links above to move to related areas, or go back to the PCNSE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNSE exam covers. They are not copied from any real exam or dump site.

Securing Traffic and App-ID only

10 questions 20 questions 30 questions 50 questions

Mixed PCNSE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNSE questions Securing Traffic and App-ID domain overview PCNSE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Securing Traffic and App-ID practice questions

What to know about Securing Traffic and App-ID

Common Securing Traffic and App-ID exam traps

Securing Traffic and App-ID questions

During a security audit, it is discovered that some HTTP traffic is being incorrectly identified as 'web-browsing' instead of 'ssl' even though the traffic uses HTTPS. The firewall is positioned as a transparent bridge and no SSL decryption is configured. What is the most likely cause?

A network administrator wants to allow only specific applications such as 'facebook-base' and 'youtube' while blocking all other applications. Which type of security rule should be used to achieve this?

An administrator notices that traffic for a known application 'ms-update' is being blocked. The security policy has a rule allowing 'ms-update' from the internal network to the internet. However, the traffic is being denied. What should the administrator check first?

Which TWO of the following are valid methods to create a custom App-ID on a Palo Alto Networks firewall?

Which THREE of the following can cause App-ID to incorrectly identify traffic?

Refer to the exhibit. A firewall administrator is troubleshooting why some applications are not being correctly identified. The firewall is running App-ID version 8000-7120. What does the 'appid packet buffer: 1024 KB' indicate?

Exhibit

Refer to the exhibit. A network engineer wants to allow only 'ms-update' and 'facebook-base' traffic. After committing the above security policy, they find that 'ssl' traffic is also being allowed. What is the most likely reason?

Exhibit

Refer to the exhibit. A network engineer notices high CPU utilization on the firewall. The output shows that 4500 sessions are pending App-ID identification. What is the most likely cause of the high number of pending sessions?

Exhibit

Order the steps to configure a security policy allowing HTTP traffic from the inside to the outside zone.

Order the steps to upgrade the PAN-OS software on a standalone firewall.

Match each PAN-OS component to its description.

Match each decryption type to its description.

An administrator needs to create a custom application for a proprietary database protocol that uses TCP port 7890. What is the first step in defining this application in App-ID?

An engineer wants to block all peer-to-peer file sharing traffic using App-ID. What security policy action should be used?

Track your progress over time

Start a Securing Traffic and App-ID only practice session

Related PCNSE topic practice pages

Manage, Monitor and Operate practice questions