PCNSE Managing Troubleshooting and High Availability Practice Test 2 — 15 Questions

Question 1

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

Accepted Answer

Increase the HA keepalive failover threshold to tolerate temporary packet loss. Option D is correct because HA keepalive failover threshold with a higher value (more missed packets) reduces false failovers. Option A is wrong because session sync does not prevent split-brain. Option B is wrong because increasing hello interval would cause faster failover, not slower. Option C is wrong because link monitoring does not address split-brain from temporary outage.

Answer

Decrease the HA1 hello interval

Answer

Enable link monitoring on all interfaces

Answer

Increase the session synchronization rate

Question 2

After a failover event, some user sessions are reset. The HA pair is configured for Active/Active with session distribution using a hash algorithm. What is the most likely reason for session resets?

Accepted Answer

Session synchronization is not configured between the HA peers. Option B is correct because in Active/Active, stateful failover requires session sync; if not enabled, sessions are not preserved. Option A is wrong because session offload is not a standard feature. Option C is wrong because route redistribution does not cause session resets. Option D is wrong because Packet Buffer Protection affects drop behavior, not session state.

Answer

Session offload is not enabled on the passive firewall

Answer

Packet Buffer Protection threshold was exceeded

Answer

The routing table is not redistributed after failover

Question 3

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. Option A is correct because the first step is to check the HA1 link connectivity, as config sync uses HA1. Option B is wrong because HA2 is for data sync. Option C is wrong because after checking connectivity. Option D is wrong because preempt is about active/passive role.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 4

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. Option C is correct because 'request high-availability sync-to-remote' pushes the active config to the passive, resolving the mismatch. Option A is wrong because that would clear state but not sync config. Option B is wrong because it would disrupt traffic. Option D is wrong because it's not a software upgrade issue.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

Question 5

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

Accepted Answer

Adjust the session distribution algorithm to match traffic patterns. Option B is correct because Active/Active uses a distribution function (like IP hash) to assign sessions to a firewall; optimizing the hash algorithm for traffic profile reduces asymmetry. Option A is wrong because session syncing all sessions would increase load. Option C is wrong because passive mode defeats purpose. Option D is wrong because link aggregation does not solve session distribution.

Answer

Change the HA mode to Active/Passive

Answer

Increase the HA2 link bandwidth using link aggregation

Answer

Enable session synchronization for all sessions

Question 6

After a power failure, both firewalls in an HA pair come up and report 'active' state. The network team confirms that the two firewalls are connected via HA1 and HA2. What is the most likely cause of the split-brain condition?

Accepted Answer

The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state. Option A is correct because the HA keepalive hold timer on HA1 is too short, causing each firewall to assume the other is dead during power-up. Option B is wrong because HA2 is for data sync. Option C is wrong because preempt is about becoming active. Option D is wrong because version mismatch would show configuration mismatch, not dual active.

Answer

The active firewall has a higher software version

Answer

Preemption is enabled on both firewalls

Answer

HA2 link is configured but not used for election

Question 7

Which TWO conditions can cause an HA pair to show a state of 'suspended'?

Accepted Answer

Configuration synchronization failure. Options A and C are correct. A: When HA1 link is down, the pair may go suspended if no alternative keepalive path. C: If the passive firewall cannot sync its configuration, it may enter suspended state. B is wrong because HA2 failure does not cause suspended; it only affects session sync. D is wrong because version mismatch typically shows 'non-functional' or 'reconnect'. E is wrong because license mismatch does not affect HA state directly.

Answer

Software version mismatch between peers

Answer

HA2 link failure

Answer

License mismatch between peers

Question 8

Which THREE steps should be taken to verify that an HA pair is ready for a scheduled failover?

Accepted Answer

Perform a 'show high-availability sync-status' to confirm config synchronization. Options A, C, and E are correct. A: Ensure session synchronization is enabled to preserve sessions. C: Verify HA2 link is up for session sync. E: Check that both firewalls have the same configuration. B is wrong because disabling preemption is not a readiness check, it's a configuration choice. D is wrong because stopping logging is not necessary and may hide issues.

Answer

Stop all logging to reduce CPU load

Answer

Disable preemption on the active firewall

Question 9

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Accepted Answer

Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup. Options C and D are correct. C: Check session sync parameters like timeout or encryption mismatch. D: Verify that the session synchronization setting is enabled on both firewalls, as it may be disabled. A is wrong because HA1 is for control, not session data; but it's used for control messages, so if HA1 is up, that's not the issue. B is wrong because restarting HA process is disruptive and not first step. E is wrong because packet buffer protection does not affect sync.

Answer

Check HA1 link utilization

Answer

Increase the packet buffer protection threshold

Answer

Restart the HA process on both firewalls

Question 10

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

Accepted Answer

The configuration on the two firewalls is not identical. Option B is correct because the reason is 'configuration mismatch'. Option A is wrong because HA1 is up (communication between IPs works). Option C is wrong because the output shows both are running. Option D is wrong because no sync failure is indicated, just mismatch.

Answer

The configuration sync operation has failed

Answer

One firewall is not running

Answer

HA1 link failure between 10.1.1.1 and 10.1.1.2

Question 11

Refer to the exhibit. An engineer configures HA with link monitoring and path monitoring. However, failover does not occur when ethernet1/2 goes down. What is the likely reason?

Accepted Answer

'link-monitoring' is configured under the high-availability hierarchy but not explicitly enabled. Option A is correct because only failed interfaces are shown? Wait the exhibit shows link-monitoring with interfaces ethernet1/1 and ethernet1/2, but the failure condition is 'any' so if either goes down, failover should occur. But the question says failover does not occur when ethernet1/2 goes down. Possibly the interface is not included? Actually the config includes both. Perhaps the issue is that path monitoring might override? No. Option C seems plausible: the group-id might be missing? But it's there. Let's think: The most common mistake is that link monitoring must be enabled globally. Option A is about global enable. Option B: HA2 misconfigured? irrelevant. Option C: group-id missing? But it's present. Option D: path monitoring interval too high? doesn't affect link monitoring. So the correct answer is A: Link monitoring is not enabled globally. The exhibit shows 'link-monitoring { interfaces ...' but global 'enable' for link monitoring is missing? Actually in Palo Alto config, you need to set 'link-monitoring enable yes' at the high-availability level. The snippet shows 'link-monitoring { interfaces ...' but no 'enable yes' before that. That is a common pitfall. So option A is correct.

Answer

The HA group-id is not unique in the network

Answer

HA2 link is down preventing failover

Answer

Path monitoring interval is set too high, causing delayed failover

Question 12

Refer to the exhibit. Based on the log, what triggered the failover?

Accepted Answer

A path monitoring group determined that the upstream ISP is unreachable. Option C is correct because the log indicates path monitoring group 'ISP1' failed, causing state change. Option A is wrong because no interface down log. Option B is wrong because no HA1 heartbeat failure. Option D is wrong because it's not a manual admin action.

Answer

Loss of HA1 heartbeat from the peer

Answer

A link failure on ethernet1/1

Answer

An administrator manually triggered a failover

Question 13

An administrator notices that the HA pair shows a state mismatch: one firewall reports active, the other reports passive, but traffic is not flowing through the active firewall. What is the most likely cause?

Accepted Answer

The HA1 link is down and preemptive mode is enabled. Option B is correct because a HA1 link failure can cause both firewalls to think they are active (split-brain), but the state mismatch indicates one sees active, one sees passive; this is often due to a preemptive configuration or hold timer issue. Option A is wrong because HA2 link failure does not cause state mismatch; it only affects session sync.

Answer

Session synchronization is incomplete

Answer

The HA2 link is down

Answer

The passive firewall has a higher priority

Question 14

During a failover test, an engineer observes that after the active firewall fails, the passive firewall takes over, but existing UDP sessions are not maintained. What is the most likely reason?

Accepted Answer

UDP sessions are not synchronized by default in active/passive mode. Option C is correct because UDP sessions are not synchronized by default in active/passive mode; TCP sessions are synced. Option A is wrong because session sync is enabled by default. Option B is wrong because failover is immediate. Option D is wrong because asymmetric routing does not prevent session sync.

Answer

The HA pair is in active/active mode

Answer

The failover delay timer is too long

Answer

Session synchronization is disabled on the passive firewall

Question 15

An HA pair is configured with active/active mode and session sync enabled. After a failover, a network administrator notices that some new TCP connections fail. The firewall logs show no drops. What is the most likely issue?

Accepted Answer

Asymmetric routing is causing the SYN packet to be processed by one firewall and the SYN-ACK by the other. Option D is correct because in active/active mode with multiple virtual routers, asymmetric routing can cause session timeouts if the return traffic hits a different firewall than the one that saw the initial SYN. Option A is wrong because session sync is enabled. Option B is wrong because ARP cache is not the root cause. Option C is wrong because flow-based routing is not a standard feature.

Answer

The ARP cache on the firewalls is stale

Answer

Flow-based routing is misconfigured

Answer

Session synchronization is not functioning for TCP