PCNSE Managing Troubleshooting and High Availability Practice Test 2 — 15 Questions

Question 1

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. The HA1 control link carries critical heartbeat and synchronization traffic between the two firewalls in an active/passive or active/active HA pair. Using a dedicated physical interface ensures that control traffic is isolated from data traffic, preventing congestion or interference that could cause false failovers or synchronization delays. The management interface (MGT) is not recommended for HA1 because it shares the control plane CPU and can be overwhelmed by management traffic, leading to HA instability.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 2

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

Accepted Answer

Increase the HA keepalive failover threshold to tolerate temporary packet loss. Increasing the HA keepalive failover threshold allows the firewalls to tolerate a brief network outage without triggering a split-brain scenario. By requiring more missed heartbeats before declaring the peer dead, the firewalls avoid both becoming active simultaneously due to transient packet loss. This directly addresses the root cause—premature failover during temporary connectivity issues.

Answer

Decrease the HA1 hello interval

Answer

Enable link monitoring on all interfaces

Answer

Increase the session synchronization rate

Question 3

After a failover event, some user sessions are reset. The HA pair is configured for Active/Active with session distribution using a hash algorithm. What is the most likely reason for session resets?

Accepted Answer

Session synchronization is not configured between the HA peers. In an Active/Active HA pair with session distribution based on a hash algorithm, each firewall handles a subset of traffic flows. Without session synchronization between the peers, the backup firewall has no session table entries for flows hashed to the primary. After a failover, the backup firewall sees these packets as new connections and resets them because it lacks the state information required to continue the existing sessions.

Answer

Session offload is not enabled on the passive firewall

Answer

Packet Buffer Protection threshold was exceeded

Answer

The routing table is not redistributed after failover

Question 4

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 5

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

Question 6

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

Accepted Answer

Adjust the session distribution algorithm to match traffic patterns. In an Active/Active HA pair, session distribution is controlled by a hash-based algorithm that determines which firewall handles a given flow. When asymmetric routing and drops occur during high session utilization, the default algorithm may not distribute traffic evenly, causing one firewall to become overloaded. Adjusting the session distribution algorithm (e.g., from IP hash to round-robin or a weighted distribution) can better match the traffic patterns and balance the load, reducing asymmetry and drops.

Answer

Change the HA mode to Active/Passive

Answer

Increase the HA2 link bandwidth using link aggregation

Answer

Enable session synchronization for all sessions

Question 7

After a power failure, both firewalls in an HA pair come up and report 'active' state. The network team confirms that the two firewalls are connected via HA1 and HA2. What is the most likely cause of the split-brain condition?

Accepted Answer

The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state. The HA1 keepalive hold timer determines how long a firewall waits for a hello message from its peer before declaring it dead. If this timer is set too low, both firewalls may boot up and not receive each other's initial keepalives in time, causing each to assume the other is unavailable and transition to active state. This results in a split-brain condition where both firewalls operate independently.

Answer

The active firewall has a higher software version

Answer

Preemption is enabled on both firewalls

Answer

HA2 link is configured but not used for election

Question 8

Which TWO conditions can cause an HA pair to show a state of 'suspended'?

Accepted Answer

Configuration synchronization failure. A configuration synchronization failure causes the HA pair to enter a 'suspended' state. When configuration sync fails, the passive peer cannot apply the active peer's configuration, breaking the synchronization requirement for HA operation. The suspended state prevents the passive peer from taking over until the configuration mismatch is resolved.

Answer

Software version mismatch between peers

Answer

HA2 link failure

Answer

License mismatch between peers

Question 9

Which THREE steps should be taken to verify that an HA pair is ready for a scheduled failover?

Accepted Answer

Perform a 'show high-availability sync-status' to confirm config synchronization. The 'show high-availability sync-status' command directly verifies that the configuration is synchronized between the HA pair, which is essential for a consistent state during failover. Without config sync, the passive firewall may not have the same policies or objects, leading to traffic drops or security gaps after failover.

Answer

Stop all logging to reduce CPU load

Answer

Disable preemption on the active firewall

Question 10

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Accepted Answer

Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup. The two most effective troubleshooting steps are A and D. A is correct because if session synchronization is disabled, sessions will not sync. Under Device > High Availability > Setup, you must verify that session synchronization is enabled on both firewalls. D is correct because mismatched parameters such as encryption, timeout, or other session sync settings can prevent synchronization. B is wrong because HA1 link utilization does not directly affect session synchronization; HA1 is for control traffic, and session data is sent over HA2 or HA3. C is wrong: increasing the packet buffer protection threshold is for buffer exhaustion issues, not session synchronization. E is wrong: restarting the HA process is a disruptive step and should only be attempted after verifying other settings; it is not a primary troubleshooting step.

Answer

Check HA1 link utilization

Answer

Increase the packet buffer protection threshold

Answer

Restart the HA process on both firewalls

Question 11

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

Accepted Answer

The configuration on the two firewalls is not identical. The 'non-functional' state in a Palo Alto Networks HA pair indicates that the configuration synchronization (config sync) has failed because the configurations on the two firewalls are not identical. This is a prerequisite for HA operation; if the configurations differ, the HA pair cannot establish a functional sync state, even if HA1 and HA2 links are up.

Answer

The configuration sync operation has failed

Answer

One firewall is not running

Answer

HA1 link failure between 10.1.1.1 and 10.1.1.2

Question 12

Refer to the exhibit. An engineer configures HA with link monitoring and path monitoring. However, failover does not occur when ethernet1/2 goes down. What is the likely reason?

Accepted Answer

'link-monitoring' is configured under the high-availability hierarchy but not explicitly enabled. In Palo Alto Networks HA configuration, link monitoring is not enabled by default even when the 'link-monitoring' block is present under the 'high-availability' hierarchy. The engineer must explicitly set 'enabled yes' within the 'link-monitoring' configuration to activate it. Without this explicit enable, the firewall will not monitor the specified interfaces for link state changes, so a failure on ethernet1/2 will not trigger a failover.

Answer

The HA group-id is not unique in the network

Answer

HA2 link is down preventing failover

Answer

Path monitoring interval is set too high, causing delayed failover

Question 13

Refer to the exhibit. Based on the log, what triggered the failover?

Accepted Answer

A path monitoring group determined that the upstream ISP is unreachable. The log entry indicates that the failover was triggered by a path monitoring group, which detected that the upstream ISP became unreachable. Path monitoring actively probes the next-hop gateway or a target IP address; when the probe fails, the firewall considers the path down and initiates a failover to the passive peer. This is distinct from HA1 heartbeat loss or link failure, as the log explicitly references the path monitoring group.

Answer

Loss of HA1 heartbeat from the peer

Answer

A link failure on ethernet1/1

Answer

An administrator manually triggered a failover

Question 14

An administrator notices that the HA pair shows a state mismatch: one firewall reports active, the other reports passive, but traffic is not flowing through the active firewall. What is the most likely cause?

Accepted Answer

The HA1 link is down and preemptive mode is enabled. When the HA1 link is down and preemptive mode is enabled, each firewall may operate independently, leading to a state mismatch where one reports active and the other passive. Traffic does not flow through the active firewall because it lacks the HA1 communication to validate the peer's state. Option A is incorrect because incomplete session synchronization does not cause a state mismatch; it only affects session redundancy. Option B is incorrect because the HA2 link is for session synchronization, not for state determination; a failure would not cause a state mismatch. Option C is incorrect because priority determines which firewall becomes active/passive but does not cause a mismatch; if the passive had higher priority, it would be active.

Answer

Session synchronization is incomplete

Answer

The HA2 link is down

Answer

The passive firewall has a higher priority

Question 15

During a failover test, an engineer observes that after the active firewall fails, the passive firewall takes over, but existing UDP sessions are not maintained. What is the most likely reason?

Accepted Answer

UDP sessions are not synchronized by default in active/passive mode. In an active/passive HA pair, session synchronization is enabled by default for TCP sessions but not for UDP sessions. UDP is considered connectionless, and the firewall does not maintain state information for UDP flows in the same way as TCP. Therefore, when a failover occurs, existing UDP sessions are not preserved because their state was never synchronized to the passive firewall.

Answer

The HA pair is in active/active mode

Answer

The failover delay timer is too long

Answer

Session synchronization is disabled on the passive firewall