PCNSE Managing Troubleshooting and High Availability Practice Test 2 — 15 Questions

Question 1

During a failover test, an engineer observes that after the active firewall fails, the passive firewall takes over, but existing UDP sessions are not maintained. What is the most likely reason?

Accepted Answer

UDP sessions are not synchronized by default in active/passive mode. In an active/passive HA pair, session synchronization is enabled by default for TCP sessions but not for UDP sessions. UDP is considered connectionless, and the firewall does not maintain state information for UDP flows in the same way as TCP. Therefore, when a failover occurs, existing UDP sessions are not preserved because their state was never synchronized to the passive firewall.

Answer

The HA pair is in active/active mode

Answer

The failover delay timer is too long

Answer

Session synchronization is disabled on the passive firewall

Question 2

An HA pair is configured with active/active mode and session sync enabled. After a failover, a network administrator notices that some new TCP connections fail. The firewall logs show no drops. What is the most likely issue?

Accepted Answer

Asymmetric routing is causing the SYN packet to be processed by one firewall and the SYN-ACK by the other. In an active/active HA pair with session sync enabled, asymmetric routing can occur after a failover if the traffic flow changes such that the SYN packet is processed by one firewall and the SYN-ACK by the other. Since session sync only synchronizes established sessions, not half-open ones, the firewall receiving the SYN-ACK does not have a session entry for the SYN, causing it to drop the SYN-ACK as a non-SYN packet without a session. The firewall logs show no drops because the drop occurs at the session lookup stage and may not be logged by default, or the drop counter is not incremented for this specific scenario.

Answer

The ARP cache on the firewalls is stale

Answer

Flow-based routing is misconfigured

Answer

Session synchronization is not functioning for TCP

Question 3

What is the recommended best practice for the HA2 keepalive timer in an active/passive HA configuration?

Accepted Answer

1000 ms. In an active/passive HA configuration, the HA2 keepalive timer should be set to 1000 ms (1 second) as a best practice. This value provides a balance between fast failover detection and network stability, ensuring that the passive firewall can detect a failure of the active firewall within a reasonable timeframe without causing false positives due to transient network issues.

Answer

2000 ms

Answer

It should be left at the default value and not changed

Answer

500 ms

Question 4

An administrator runs 'show high-availability state' and sees that the local firewall is in 'passive' state, but the remote firewall shows 'active'. However, the HA1 link is up and the configuration is synchronized. What could cause the passive firewall to not take over after the active fails?

Accepted Answer

The HA2 link is down. If the HA2 link is down, the passive firewall cannot synchronize session state from the active firewall. In Palo Alto Networks HA implementations, the passive firewall requires a functional HA2 link to be considered fully operational and ready to take over; without it, the passive will not assume the active role even if the active fails. The HA1 link ensures heartbeats and configuration synchronization, but state synchronization over HA2 is critical for failover eligibility.

Answer

The configuration is not synchronized

Answer

Session synchronization is not fully complete

Answer

Preemptive mode is disabled and the passive firewall has a lower priority

Question 5

Which TWO of the following are prerequisites for configuring high availability on Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Both firewalls must run the same software version. Both firewalls in a high availability (HA) pair must run the same PAN-OS software version to ensure configuration synchronization and stateful failover compatibility. The HA synchronization process uses the HA2 link to replicate configurations and session state, and version mismatches can cause sync failures or unexpected behavior during failover.

Answer

Both firewalls must have management IPs in different subnets

Answer

Both firewalls must have the same interface naming

Answer

Both firewalls must have the same licenses

Question 6

An engineer is troubleshooting an HA pair where session synchronization is not working. Which THREE steps should be taken to diagnose the issue? (Choose three.)

Accepted Answer

Verify that the HA2 link is operationally up. The HA2 link is the dedicated link for session synchronization in a Palo Alto Networks HA pair. If the HA2 link is not operationally up, session state information cannot be exchanged between the firewalls, causing synchronization to fail. Verifying the HA2 link status is a fundamental first step in troubleshooting session sync issues.

Answer

Check the HA1 link status using 'show high-availability state'

Answer

Enable flow-based routing on both firewalls

Question 7

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.

Question 8

A network engineer is configuring an active/passive HA pair of Palo Alto Networks firewalls. The engineer wants to ensure that a specific interface failure triggers a failover, but only if the interface loses connectivity to its directly connected next-hop router. Which two configuration settings must be enabled to achieve this behavior?

Accepted Answer

Enable link monitoring on the interface.. Link monitoring detects a physical link failure on the interface and triggers a failover. Option D is correct because path monitoring goes beyond link state by sending ICMP pings to a specific next-hop IP address, ensuring that even if the link is up but the next-hop router is unreachable, a failover occurs. Together, these settings provide the desired behavior: failover only when the interface loses connectivity to its directly connected next-hop router.

Answer

Configure HA2 as a backup heartbeat link.

Answer

Set HA1 link monitoring to ping the peer firewall's management IP.

Answer

Set the passive link state to 'auto'.

Question 9

A company operates a pair of PA-3220 firewalls in an active/passive HA configuration. The passive firewall is experiencing intermittent HA keepalive failures, causing unnecessary failovers every few minutes. The network engineer checks the HA1 interface statistics and notices packet loss on the dedicated HA1 link. The engineer suspects a physical layer issue. However, the engineer also wants to reduce the sensitivity of the HA keepalive mechanism to tolerate occasional packet loss without triggering a failover. The firewalls are currently using default HA keepalive settings. What should the engineer do to reduce the frequency of false failovers without compromising the ability to detect a true failure?

Accepted Answer

Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.. Increasing the HA keepalive interval and the number of missed keepalives allowed makes the passive firewall less sensitive to transient packet loss on the HA1 link. This reduces false failovers while still ensuring that a sustained loss of heartbeats (indicating a true failure) will eventually trigger a failover. The default HA keepalive settings use a 1-second interval with 3 missed keepalives allowed; increasing these values provides tolerance for intermittent loss without disabling failure detection.

Answer

Disable HA1 link monitoring and rely solely on path monitoring.

Answer

Change the HA mode to active/active to balance traffic and reduce load on the active unit.

Answer

Enable HA2 and configure it as a second heartbeat link for redundancy.

Question 10

An engineer is configuring a Palo Alto Networks firewall to participate in an active/passive HA pair. The HA1 control link and HA2 data link have been physically connected and assigned to dedicated interfaces. Before committing, the engineer verifies the HA configuration and notices that the HA1 link is up, but the HA2 link shows as down. Which TWO configuration settings are required on both firewalls to ensure the HA2 link becomes operational and can synchronize sessions? (Choose two.)

Accepted Answer

Configure the HA2 interface with an IP address and ensure it is in the same subnet on both firewalls.. The HA2 data link requires an IP address on each firewall, and both addresses must be in the same subnet to establish connectivity. Additionally, session synchronization must be explicitly enabled in the HA configuration for the link to carry session state. Without these, the HA2 link remains down and sessions are not synchronized, defeating the purpose of HA.

Answer

Enable HA2 keep-alive on the HA2 interface.

Answer

Configure the HA2 interface with the same MAC address on both firewalls.

Answer

Set the HA2 interface to Layer 3 mode and assign it to the same security zone on both firewalls.

Question 11

An engineer is troubleshooting session synchronization in an active/passive HA pair. The active firewall shows sessions in the session table, but the passive firewall does not have the same sessions. The HA2 link is up, and both firewalls show 'synchronized' in HA status. Which action should the engineer take to verify that session synchronization is occurring?

Accepted Answer

Run 'show session-synchronization' on the active firewall.. To verify session synchronization, the engineer should run 'show session-synchronization' on the active firewall. This command provides details on synchronization status, including the number of sessions synchronized and any failures. The HA2 link being up does not guarantee synchronization; this command confirms it.

Answer

Run 'show high-availability session-synchronization' on the active firewall.

Answer

Run 'show session all' on the passive firewall.

Answer

Check the HA2 link statistics for packet drops.

Question 12

A network security engineer is troubleshooting an active/passive HA pair of PA-5220 firewalls. The active firewall is experiencing intermittent packet loss and high CPU utilization. The engineer suspects that the HA1 control link is flapping, causing unnecessary failover attempts. Which command should the engineer use to verify the status and stability of the HA1 link?

Accepted Answer

show high-availability interface ha1. The 'show high-availability interface ha1' command provides detailed statistics about the HA1 interface, including link status and error counters. This allows the engineer to assess whether the link is flapping, which could cause unnecessary failovers. Other commands either provide only high-level state or are invalid, making them unsuitable for this specific troubleshooting task.

Answer

show ha1 statistics

Answer

show high-availability state

Answer

debug ha1 on

Question 13

An engineer is troubleshooting an active/passive HA pair where the passive firewall is not synchronizing sessions. The HA1 link is up and the HA state is 'passive'. Which two actions should the engineer take to resolve the issue? (Choose two.)

Accepted Answer

Verify that the HA2 link is configured and up, and that the HA2 keepalive is enabled.. Session synchronization requires a functional HA2 link and the 'Session Synchronization' option enabled. Without both, the passive firewall cannot receive session updates. The engineer should verify HA2 connectivity and ensure session sync is enabled. These two actions directly address the most common causes of session sync failure in an HA pair.

Answer

Verify that the HA1 link is encrypted with a pre-shared key.

Answer

Configure the HA2 link to use the management interface to simplify cabling.

Answer

Check that the HA2 link is configured with the same IP addresses on both firewalls.

Question 14

An engineer is troubleshooting session synchronization in an active/passive HA pair. The active firewall is processing traffic, but the passive firewall shows 'HA state: passive' with no sessions synchronized. The HA1 link is up. The HA2 link uses a dedicated 10G interface. Which command should the engineer run first to verify the HA2 link status and session synchronization?

Accepted Answer

show high-availability interface ha2. When session synchronization fails in an HA pair, the first step is to verify the HA2 link status because it is dedicated to session sync. The command 'show high-availability interface ha2' provides immediate insight into whether the HA2 interface is operational and passing traffic. If it is down or misconfigured, synchronization cannot occur, so this command efficiently isolates the problem.

Answer

show session all filter state active

Answer

show high-availability state-synchronization

Answer

show high-availability state

Question 15

A network security engineer is troubleshooting an issue where a Palo Alto Networks firewall is not receiving updates from the Palo Alto Networks Update Server. The firewall is deployed in a high-security environment with no direct internet access. The engineer has configured an internal server as an update server and set the firewall to use it. However, the firewall still attempts to connect to the default Palo Alto Networks Update Server. The engineer verifies that the update server setting is correctly configured under Device > Setup > Services. What could be the reason for this behavior?

Accepted Answer

The firewall's management interface is configured to use a proxy server, and the proxy is not configured to allow access to the internal update server.. When a proxy server is configured on the management interface, the firewall routes all management-plane traffic, including update requests, through that proxy. If the proxy does not permit access to the internal update server, the firewall cannot reach it, and it may fall back to attempting the default Palo Alto Networks Update Server if the proxy allows that. Thus, the proxy configuration is the most likely cause of the observed behavior.

Answer

The firewall is configured to use the default update server because the 'Update Server' setting is overridden by a content update schedule.

Answer

The internal update server is not reachable on the management interface due to a routing or firewall rule.

Answer

The firewall's management interface lacks a valid DNS server configuration.