A customer has an application that is being identified as unknown-top for one of their custom PostgreSQL database connections.
Which two configuration options can be used to correctly categorize their custom database application? (Choose two.)
A . Application Override policy.
B . Security policy to identify the custom application.
C . Custom application.
D . Custom Service object.
Answer: A,C
Explanation:
Unlike the App-ID engine, which inspects application packet contents for unique signature elements, the Application Override policy’s matching conditions are limited to header-based data only. Traffic matched by an Application Override policy is identified by the App-ID entered in the Application entry box. Choices are limited to applications currently in the App-ID database. Because this traffic bypasses all Layer 7 inspection, the resulting security is that of a Layer-4 firewall. Thus, this traffic should be trusted without the need for Content-ID inspection. The resulting application assignment can be used in other firewall functions such as Security policy and QoS. Use CasesThree primary uses cases for Application Override Policy are:
To identify “Unknown” App-IDs with a different or custom application signature To re-identify an existing application signature
To bypass the Signature Match Engine (within the SP3 architecture) to improve processing timesA discussion of typical uses of application override and specific implementation examples is here: https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application-Override/ta-p/65513
Leave a Reply