Exam PCNSE topic 1 question 78 discussion

I'm thinking C. Here's my train of thought, let me know what you think. B and D are certainly not right. A and C could be both technically true, but which is more accurate? A indicates that "after app has been identified", so we can interpret that in the Flow Diagram as the step in App-ID which says "Pattern based application identification" however, considering the Packet Flow Sequence, after the app is identified, there are still several steps that don't lead directly to Content ID. First it checks for policy matches that will allow it (so it might still get dropped). Then it will check if there are any Security Profiles (ContentID) that will be applicable. QoS and SSL Decryption also might occur at this point. My point is there's a whole bunch of stuff still going on between the "app being identified" and content inspection. My conclusion is that whenever content inspection is performed it's always before packet forwarding. And it is not always the case that it happens immediatly after the app has been identified.

I feel like this question could be simply asked as "When do you learn to read?" A: After you are done being a toddler C: Sometime before you die of old age Technically both are correct. Seriously Palo? Are we supposed to play the choose the more correct answer game? C feels like the broader safer answer. If the Application is Incomplete or Insufficient Data and can't be identified, that doesn't stop Palo from attempting content inspection so it would make A questionable.

What if the application is not identified ? in that case A won't be valid answer.

https://threatfiltering.com/packet-flow-and-order-of-operations-in-pan-os/#:~:text=Order%20of%20operations%20in%20Palo%20Alto%20Networks%20firewalls,Application%20Identification%20%3E%20Content%20Inspection%20%3E%20Egress%20Forwarding.

Forwarding is the last stage and therefore the content inspection is before it

While C isn't technically wrong (since inspection does happen before forwarding), A is the more accurate answer because content inspection happens specifically after the application has been identified. That’s the critical part of the packet flow, where the firewall decides how to treat the traffic based on its policies.

A The question does not say that the application does not get identified.

Content inspection occurred after the session app identified. If app not identified, it would be app override policy match >> pattern based app identification >> security policy lookup based on app >> Rule match with action allowed >> Content inspection

C is not possible because there are several options before packet forwarding, content inspection is one of them. content inspection only happens if the traffic has gone through the app-id engine

According to this Before the packet forwarding is "closer" https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

A. after the application has been identified Content inspection is typically performed after the application has been identified in the packet flow process of many firewall systems, including Palo Alto Networks firewalls. This allows for the content of the packets to be inspected for threats and policy violations based on the identified application.

My two cents. It's C. Scroll down to section 6, Content Inspection, happens right before Forwarding/Egress. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

Answer: A

Can find the answer here, which is the same as Question 65. https://live.paloaltonetworks.com//t5/image/serverpage/image-id/12862i950F549C7D4E6309

The content inspection is performed ONLY if application is identified. If it's an unknown app then the content inspection doesn't happen but the packet it's forwarded, if the security policy allow.

Agree A: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0 SECTION 5: APPLICATION IDENTIFICATION (APP - ID) SECTION 6: CONTENT INSPECTION SECTION 7: FORWARDING/EGRESS

I'm going to have to go with option C here. A and D both are technically correct. However, A and D are both not neccessary steps in the process. C is a neccessary step. This is one of those "which is the better answer" scenarios.