Which two items must be configured when implementing application override and allowing traffic through the firewall? (Choose two.)

To implement an application override that allows traffic, two distinct policy rules are mandatory. First, an Application Override policy rule must be created. This rule identifies traffic based on parameters like port and protocol and instructs the firewall to bypass the standard App-ID engine, classifying the traffic as a specified application. Second, a Security policy rule is required to define the action for this newly classified traffic. To permit the flow, this Security policy rule must be configured with an "allow" action for the application specified in the override rule. Without both rules, the configuration is incomplete and will not allow the intended traffic.

A. Application filter: This is an object for grouping existing applications in security policies. It is not a required component for creating an application override.

D. Custom app: While often used with application override, it is not mandatory. You can override traffic to be identified as a pre-defined, existing application.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Application Override". This section states

"After you create an application override policy rule

you must create a Security policy rule that allows the application." This explicitly confirms the requirement for both policy types.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Use Case: Configure an Application Override Policy". The documented procedure clearly outlines the creation of an Application Override rule (Step 2) and a corresponding Security policy rule (Step 3) as the essential steps to make the feature functional.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Security Policy". This section explains that Security policy rules are the fundamental mechanism for controlling traffic

stating that a rule must exist to explicitly allow a session through the firewall. This applies to all traffic

including that identified via an override.