PCNSE · Question #640
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same firewall. The update contains an application…
The correct answer is A. Custom application. When a custom application's signatures conflict with a pre-defined application from a dynamic update, the firewall prioritizes the custom application.
Question
An administrator creates a custom application containing Layer 7 signatures. The latest application and threat dynamic update is downloaded to the same firewall. The update contains an application that matches the same traffic signatures as the custom application. Which application will be used to identify traffic traversing the firewall?
Options
- ACustom application
- BUnknown application
- CDownloaded application
- DIncomplete application
How the community answered
(20 responses)- A95% (19)
- B5% (1)
Why each option
When a custom application's signatures conflict with a pre-defined application from a dynamic update, the firewall prioritizes the custom application.
Palo Alto Networks firewalls give precedence to custom applications over pre-defined applications from dynamic updates if their signatures overlap. This ensures that custom definitions, which are specifically crafted by the administrator, take precedence for traffic identification.
The traffic will be identified, not classified as unknown, because there are matching signatures.
The downloaded application is overridden by the custom application in case of signature conflict.
The traffic will be identified by a specific application, not incomplete, as signatures are matched.
Concept tested: Custom application precedence
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/application-and-threat-content-updates/custom-applications.html
Topics
Community Discussion
No community discussion yet for this question.