Exam NetSec-Analyst Topic 1 Question 6 Discussion

Actual exam question for Palo Alto Networks's NetSec-Analyst exam
Question #: 6
Topic #: 1
An analyst notices that Application ID (App-ID) for a specific custom application is consistently identifying traffic as 'unknown-tcp' despite having a custom App-ID signature defined. The policy allowing this application uses this custom App-ID. What are two (2) likely reasons for this misidentification?

Suggested Answer: A,B Vote an answer

If a custom App-ID is consistently identifying traffic as 'unknown-tcp', it suggests either the traffic is being matched by a broader policy (like 'any' or a service-based rule) before the App-ID can classify it (rule order - A), or the custom App-ID signature itself is flawed and not correctly identifying the traffic patterns of the application (B). While other options might cause issues, these two are direct causes of 'unknown-tcp' for a known custom application.

by Morton at Oct 05, 2026, 04:16 AM

Limited Time Offer

15%

Off

Get Premium NetSec-Analyst Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10