PCNSE URL Filtering and Application Control 2

Question 1

What is App-ID in Palo Alto Networks firewalls?

Accepted Answer

A technology that identifies applications by analyzing traffic behavior, signatures, and protocol decoding

Answer

App-ID is Palo Alto's application identification technology that uses multiple techniques including behavioral analysis, decoding, and signatures to accurately identify applications regardless of port or encryption.

Question 2

What is an Application Override policy in Palo Alto Networks used for?

Accepted Answer

To force the firewall to skip App-ID processing and treat traffic as a custom application

Answer

Application Override policies force the firewall to bypass App-ID processing for matching traffic and assign a custom application identifier, used to reduce processing overhead for trusted internal traffic.

Question 3

Which feature allows Palo Alto firewalls to identify users behind a shared IP address for policy enforcement?

Accepted Answer

User-ID

Answer

User-ID maps IP addresses to usernames through integration with Active Directory, Captive Portal, and other sources, enabling user-based security policy enforcement.

Question 4

What is the purpose of Application Filters in Palo Alto Networks security policy?

Accepted Answer

To dynamically group applications based on characteristics like category, risk, or technology

Answer

Application Filters dynamically match applications based on defined attributes (category, subcategory, technology, risk level), automatically including new applications that match the criteria.

Question 5

What happens when a Palo Alto firewall encounters an application that App-ID cannot identify during the initial packets?

Accepted Answer

The firewall applies the policy for 'unknown-tcp' or 'unknown-udp' while continuing to identify the application

Answer

While App-ID works to classify an unknown application, the firewall applies the security policy for unknown-tcp or unknown-udp, allowing policy to be applied before full identification.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE URL Filtering and Application Control 2