Palo Alto Networks Certified Network Security Engineer (PCNSE)Manage and OperateMedium
A security administrator observes that after a recent content update, a critical internal application (Application-X) is no longer matching its specific security policy rule and is instead being caught by a broader 'deny-all' rule. Upon investigation, it's found that Application-X is now being identified as 'web-browsing' instead of its unique application ID. What is the most likely cause for this behavior?
- AThe application definition for Application-X has been deprecated in the new content update.
- BThe security policy rule for Application-X has been inadvertently moved below the 'deny-all' rule.
- CThe firewall's application override policy for Application-X is no longer valid or has been removed.
- DThe content update introduced a new signature for 'web-browsing' that now incorrectly identifies Application-X.
Show answer & explanationAnswer & explanation
Correct answer: C. The firewall's application override policy for Application-X is no longer valid or has been removed.
When a custom or internal application is identified incorrectly, especially after a content update, an application override is typically used to force the firewall to identify it correctly. If this override is removed or becomes invalid, the firewall will revert to its default (and possibly incorrect) identification.
Why the other options are wrong
- A. Application definitions being deprecated usually means they are merged or replaced, not that they revert to a generic 'web-browsing' identification without an override in place.
- B. Rule order issues are common, but the problem states the application is *identified* incorrectly, not that the rule itself is misordered. If the rule was misordered, the identification would likely still be correct, but the action different.
- D. While possible, a content update introducing a *new* signature for 'web-browsing' that *incorrectly* identifies a specific, existing application is less likely than an override issue, especially if the application was previously identified correctly.
Application Override
An Application Override is used to force the firewall to identify specific traffic flows as a particular application, bypassing the standard App-ID engine for those flows.
- Useful for custom or internal applications not recognized by App-ID.
- Ensures consistent application identification.
- Takes precedence over standard App-ID signatures.
Memory trick: When App-ID gets confused, check the 'Override' button.