An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company's proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.
Which option would achieve this result?
To identify the proprietary accounting application traffic reliably and scan it for threats, creating a custom App-ID and enabling scanning on the advanced tab is the appropriate solution. This approach ensures that the traffic is recognized specifically as the company’s accounting application and allows for thorough threat scanning. Application Override policies, on the other hand, do not allow for detailed application signatures and may disable higher-layer threat scanning, which is essential for security in this context.
A is the correct answer: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/manage-custom-or-unknown-applications.html
absolutely A. take note of "reliably identify" here - which excludes B.
True, it's also said ' to scan this traffic for threats' which exludes B too
Looks like A https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK
It is B. Once you enable application override it will not go beyound layer 4.
I agree
Then how would this be accomplished ? "and to scan this traffic for threats."
Application Override policy disables scan for threats
it depends if you choose a parent app or not
A is correct
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/manage-custom-or-unknown-applications.html "create a custom application and define an application override policy"
D option is not saying "custom" but - Create an Application Override policy. Create a Custom Application with a signature and attach it to a security policy, or create a custom application and define an application override policy https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/manage-custom-or-unknown-applications
Correct a https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK