PCCSA · Question #15
Palo Alto Networks App-ID uses information from which source to help identify an application in network traffic?
The correct answer is B. traffic behavioral analysis. App-ID employs traffic behavioral analysis as one of its core classification techniques, examining how traffic actually behaves on the network - such as handshake patterns, data exchange sequences, and protocol characteristics - rather than relying on simple header fields. This a
Question
Options
- APAN-DB URL database
- Btraffic behavioral analysis
- Csource port in packet header
- Ddestination IP address in packet header
How the community answered
(25 responses)- B88% (22)
- C8% (2)
- D4% (1)
Explanation
App-ID employs traffic behavioral analysis as one of its core classification techniques, examining how traffic actually behaves on the network - such as handshake patterns, data exchange sequences, and protocol characteristics - rather than relying on simple header fields. This allows it to identify applications even when they disguise themselves over non-standard ports or shared protocols.
Why the distractors are wrong:
- A (PAN-DB URL database): PAN-DB is used by the URL Filtering security profile to categorize web destinations, not by App-ID to classify application traffic.
- C (Source port): Traditional port-based firewalls rely on destination ports (not even source ports), which is exactly the legacy approach App-ID was designed to replace - modern apps routinely use non-standard or shared ports.
- D (Destination IP address): An IP address tells you where traffic is going, not what application is generating it; many applications share the same IP infrastructure (e.g., cloud-hosted SaaS).
Memory tip: Think "App-ID = Application Detective." A detective observes behavior, not just a name tag. App-ID watches how traffic behaves (handshakes, patterns, protocols) to unmask the application, just as a detective catches a disguised suspect by their actions, not their claimed identity.
Topics
Community Discussion
No community discussion yet for this question.