PCNSE · Question #154
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that…
The correct answer is A. Custom application. When a custom application and a dynamically updated application share the same Layer 7 traffic signatures, the custom application always takes precedence. This is by design: Palo Alto Networks ensures that administrator-defined custom applications are not silently overridden by…
Question
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same NGFW. The update contains an application that matches the same traffic signatures as the custom application. Which application should be used to identify traffic traversing the NGFW?
Options
- ACustom application
- BSystem logs show an application error and neither signature is used.
- CDownloaded application
- DCustom and downloaded application signature files are merged and both are used
How the community answered
(35 responses)- A89% (31)
- B6% (2)
- C3% (1)
- D3% (1)
Explanation
When a custom application and a dynamically updated application share the same Layer 7 traffic signatures, the custom application always takes precedence. This is by design: Palo Alto Networks ensures that administrator-defined custom applications are not silently overridden by content updates. This protects policy intent and prevents unexpected behavior after an update. The firewall will continue to identify matching traffic using the custom application's App-ID signature, not the downloaded one.
Topics
Community Discussion
No community discussion yet for this question.