PCNSE Practice Test 9 — 10 Questions

Question 1

Based on the exhibit, what is the impact of the current HA state on the network?

Accepted Answer

Sessions will not be preserved during a failover. Option C is correct. The HA2 link is down, causing session synchronization to be not synchronized. Traffic continues to flow through the active firewall, but sessions will not be maintained during a failover. Option A is wrong because HA1 is up so control traffic works. Option B is wrong because configuration sync is synchronized. Option D is wrong because preemptive is disabled.

Answer

Configuration changes are not synchronized

Answer

The passive firewall will preempt the active when the active fails

Answer

The HA pair cannot perform a failover

Question 2

In an HA active/passive setup, the engineer wants to ensure that during a failover, existing FTP data sessions are not interrupted. What additional configuration is required beyond default session synchronization?

Accepted Answer

Configure an application layer gateway (ALG) for FTP. Option C is correct because FTP is an application-layer protocol that requires ALG support; session sync alone does not handle FTP data connections. Option A is wrong because asymmetric routing is not related. Option B is wrong because UDP session sync is not needed for FTP. Option D is wrong because HA3 is for packet forwarding, not session sync.

Answer

Use HA3 link for session synchronization

Answer

Enable asymmetric routing support

Answer

Enable UDP session synchronization

Question 3

A firewall in an HA pair is being upgraded. The administrator wants to minimize traffic loss. What is the recommended procedure for upgrading the passive firewall in an active/passive pair?

Accepted Answer

Upgrade the passive firewall, failover to it, then upgrade the original active. Option A is correct because you should upgrade the passive firewall first, then perform a manual failover, then upgrade the new passive firewall. Option B is wrong because upgrading both at once causes downtime. Option C is wrong because you should upgrade passive first, not active. Option D is wrong because suspending HA is unnecessary.

Answer

Upgrade the active firewall first, then failover to the passive

Answer

Suspend HA, upgrade both, then re-enable HA

Answer

Upgrade both firewalls simultaneously after disconnecting HA links

Question 4

During a network incident, an engineer notices that after an HA failover, some sessions are not active on the new active firewall. The 'show session all' command shows the sessions with state 'half-closed'. What is the most likely cause?

Accepted Answer

The firewall failed to properly synchronize the TCP sessions before the failover. Option B is correct because TCP session pickup may fail if the original firewall did not sync the session properly, leaving them in half-closed state. Option A is wrong because asymmetric routing affects new sessions, not existing. Option C is wrong because HA timer issues cause failover problems, not session state. Option D is wrong because ARP timeout affects connectivity, not session state.

Answer

The HA2 link failover timer is set too low

Answer

The ARP timeout on the next-hop router is too short

Answer

Asymmetric routing is causing the firewall to see only one direction of traffic

Question 5

An engineer is troubleshooting an HA pair where session synchronization is not working. Which THREE steps should be taken to diagnose the issue? (Choose three.)

Accepted Answer

Verify that the HA2 link is operationally up. Options A, B, and E are correct. Checking HA2 link status, verifying session sync status, and reviewing logs help identify sync issues. Option C is wrong because HA1 is for control, not session sync. Option D is wrong because flow-based routing is not a standard feature for session sync.

Answer

Check the HA1 link status using 'show high-availability state'

Answer

Enable flow-based routing on both firewalls

Question 6

Which TWO statements about active/active HA mode are true compared to active/passive mode? (Choose two.)

Accepted Answer

Active/active requires enabling asymmetric routing support. Options B and D are correct. Active/active requires asymmetric routing support and loadbalances traffic. Option A is wrong because active/passive is more common. Option C is wrong because active/active does not eliminate failover. Option E is wrong because config is not automatically synced differently.

Answer

Active/active eliminates the need for failover

Answer

Active/active automatically synchronizes configuration changes

Answer

Active/active is the default and most commonly deployed mode

Question 7

Based on the exhibit, what is the most likely cause of the warnings?

Accepted Answer

Both the primary and backup HA2 links are down. Option A is correct. The HA2 link (ethernet1/3) is down, and the backup link (ethernet1/5) also shows missing keepalive, indicating both primary and backup HA2 links are down. Option B is wrong because HA3 is for packet forwarding, not session sync. Option C is wrong because HA2 timers are default. Option D is wrong because configuration sync uses HA1, not HA2.

Answer

The HA3 link is misconfigured

Answer

Configuration synchronization is failing

Answer

The HA2 keepalive timer is set too low

Question 8

An organization has configured an active/passive high availability pair of Palo Alto Networks firewalls. During a maintenance window, the active firewall was rebooted. After the reboot, the passive firewall became active, but the session table on the original active firewall is incomplete. The administrator notices that session synchronization is not working properly. Which two configuration checks should the technician perform to resolve this issue?

Accepted Answer

Verify that the HA2 link is operational and has sufficient bandwidth.. Session synchronization uses the HA2 link, so verifying its operation (A) is critical. Additionally, session sync must be enabled in the HA configuration and the firewalls should run the same software version (C) to ensure compatibility. Option B (HA1) is for heartbeat, not synchronization. Option D is incorrect because disabling encryption does not improve sync reliability. Option E (heartbeat hold timer) affects failover timing, not synchronization.

Answer

Check that the session synchronization encryption is disabled to reduce latency.

Answer

Validate that the heartbeat hold timer is set to a value greater than the failover delay.

Answer

Confirm that the HA1 link is using the correct IP address and is in the same subnet.

Question 9

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

Accepted Answer

Incorrect gateway IP address in portal configuration. When a user can authenticate to the portal but cannot connect to the gateway, the portal may be supplying the wrong gateway IP address. The client uses this IP to initiate the gateway connection. If it is incorrect, the connection fails.

Answer

User not assigned a license

Answer

Gateway interface not in the same zone as portal

Answer

Gateway MTU mismatch

Question 10

Which THREE of the following are valid configuration elements for a tunnel interface in Palo Alto Networks?

Accepted Answer

Zone. A tunnel interface requires an IP address, a zone assignment, and optionally a management profile for management access.

Answer

Traffic shaping policy

Answer

Netflow profile

PCNSE Practice Test 9 — 10 Questions

Exhibit

PCNSE Practice Test 9 — 10 Questions

Exhibit