PCNSE Managing Troubleshooting and High Availability Practice Test 3 — 15 Questions

Question 1

A security engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The engineer wants to ensure that only threat logs and traffic logs are forwarded, and that they are sent in Common Event Format (CEF). Which two actions must the engineer take to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Log Forwarding profile that includes only threat and traffic log types.. To forward only threat and traffic logs in CEF format, the engineer must create a Syslog server profile with the format set to CEF, and a Log Forwarding profile that includes only threat and traffic log types and references that server profile. These two actions ensure that the correct logs are generated (via logging on rules and security profiles) and forwarded in the desired format.

Answer

Create a custom log format for CEF and apply it to the Log Forwarding profile.

Answer

Enable logging on all security policy rules to generate threat and traffic logs.

Answer

Set the syslog server profile to use TCP instead of UDP for reliable delivery.

Question 2

A security engineer is configuring an active/passive HA pair of Palo Alto Networks firewalls. The engineer wants to ensure that the passive firewall does not become active unless the active firewall fails. The engineer also wants to minimize failover time. Which HA configuration should the engineer use?

Accepted Answer

Configure link monitoring and path monitoring to detect failures quickly and trigger failover.. To ensure the passive firewall only becomes active upon failure and to minimize failover time, the engineer should configure link monitoring and path monitoring. These features enable quick detection of failures in monitored links or paths, triggering an immediate failover to the passive firewall. This meets both requirements: the passive remains passive until a failure occurs, and failover happens swiftly to minimize downtime.

Answer

Set the HA timers to a higher value to prevent unnecessary failovers.

Answer

Configure HA group IDs and ensure that the passive firewall is set to passive mode with a lower priority.

Answer

Enable preemption and set the active firewall's priority higher than the passive firewall's priority.

Question 3

An administrator is configuring HA on a pair of firewalls. The administrator wants to ensure that the passive firewall does not process traffic while the active firewall is functioning. Which HA mode should be configured?

Accepted Answer

Active/Passive. Active/Passive HA mode ensures that only one firewall is active at a time, with the other in a passive standby state. The passive firewall does not forward traffic but keeps sessions synchronized. This provides high availability with a dedicated standby. Active/Active mode would have both firewalls processing traffic, which does not meet the requirement.

Answer

Active/Standby

Answer

Active/Active

Answer

Cluster

Question 4

A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?

Accepted Answer

Split brain. In a Palo Alto Networks active/passive HA configuration, if the heartbeat fails, both firewalls assume the other is down and both transition to 'active' state. This unintended condition is called split brain. It is not a valid configuration like Active/Active, which is intentionally configured and requires separate virtual routers or security zones.

Answer

Link failure

Answer

Active/Active

Answer

Passive/Passive

Question 5

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

Accepted Answer

Enable session sync on HA2.. Enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Answer

Configure HA3 for stateful inspection.

Answer

Increase HA1 keepalive timer.

Answer

Enable config sync on HA1.

Question 6

Based on the exhibit, what caused the last failover?

Accepted Answer

The HA1 keepalive from the peer was lost.. The exhibit shows 'HA1 keepalive from the peer was lost' as the last failover reason. In an active/passive HA pair, the passive firewall monitors HA1 keepalive messages from the active peer. When these keepalives are not received within the configured hello interval (default 1 second) and hold timer (default 3 seconds), the passive firewall assumes the active peer has failed and initiates a failover to become active.

Answer

The HA2 link went down.

Answer

A preemption event occurred.

Answer

The peer firewall was rebooted.

Question 7

Arrange the steps to enable and configure GlobalProtect on a Palo Alto Networks firewall.

Accepted Answer

First configure the GlobalProtect portal, then configure the GlobalProtect gateway, then configure the GlobalProtect agent (client configuration), and finally configure security policies.. The correct sequence for enabling and configuring GlobalProtect on a Palo Alto Networks firewall starts with configuring the portal, which handles authentication and client settings. Next, the gateway is configured to manage VPN connections. Then, the GlobalProtect agent (client configuration) is set up to push settings to endpoints. Finally, security policies are applied to allow GlobalProtect traffic. Following this order ensures dependencies are satisfied and reduces configuration errors.

Answer

First configure the GlobalProtect gateway, then configure the GlobalProtect portal, then configure the GlobalProtect agent, and finally configure security policies.

Answer

First configure the GlobalProtect agent, then configure the GlobalProtect portal, then configure the GlobalProtect gateway, and finally configure security policies.

Answer

First configure security policies, then configure the GlobalProtect portal, then configure the GlobalProtect gateway, and finally configure the GlobalProtect agent.

Question 8

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. In an Active/Passive HA pair, the passive firewall monitors the active firewall's liveness via the HA1 control link. By default, only the HA1 link failure triggers a failover; the management interface is not monitored for HA state transitions. Therefore, if the management interface goes down but the HA1 link remains up, the passive firewall does not detect a failure and will not become active.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 9

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. The HA1 control link carries critical heartbeat and synchronization traffic between the two firewalls in an active/passive or active/active HA pair. Using a dedicated physical interface ensures that control traffic is isolated from data traffic, preventing congestion or interference that could cause false failovers or synchronization delays. The management interface (MGT) is not recommended for HA1 because it shares the control plane CPU and can be overwhelmed by management traffic, leading to HA instability.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 10

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 11

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

Question 12

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

Accepted Answer

Adjust the session distribution algorithm to match traffic patterns. In an Active/Active HA pair, session distribution is controlled by a hash-based algorithm that determines which firewall handles a given flow. When asymmetric routing and drops occur during high session utilization, the default algorithm may not distribute traffic evenly, causing one firewall to become overloaded. Adjusting the session distribution algorithm (e.g., from IP hash to round-robin or a weighted distribution) can better match the traffic patterns and balance the load, reducing asymmetry and drops.

Answer

Change the HA mode to Active/Passive

Answer

Increase the HA2 link bandwidth using link aggregation

Answer

Enable session synchronization for all sessions

Question 13

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Accepted Answer

Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup. Option A is correct because session synchronization must be explicitly enabled in Device > High Availability > Setup on both peers; if the checkbox is cleared on either firewall, sessions will not replicate even though HA1/HA2 heartbeats are up. Option D is correct because the session synchronization settings (e.g., sync encryption, session timeout, and related parameters) must match on both peers; a mismatch such as encryption enabled on one side but not the other silently prevents session state from being exchanged. Options B, C, and E are not the most effective steps: HA1 utilization affects heartbeat/control traffic rather than session sync (which normally uses HA2), packet buffer protection is unrelated to session replication, and restarting the HA process is a disruptive action that does not address configuration causes of sync failure.

Answer

Check HA1 link utilization

Answer

Increase the packet buffer protection threshold

Answer

Restart the HA process on both firewalls

Question 14

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

Accepted Answer

The configuration on the two firewalls is not identical. The 'non-functional' state in a Palo Alto Networks HA pair indicates that the configuration synchronization (config sync) has failed because the configurations on the two firewalls are not identical. This is a prerequisite for HA operation; if the configurations differ, the HA pair cannot establish a functional sync state, even if HA1 and HA2 links are up.

Answer

The configuration sync operation has failed

Answer

One firewall is not running

Answer

HA1 link failure between 10.1.1.1 and 10.1.1.2

Question 15

Refer to the exhibit. An engineer configures HA with link monitoring and path monitoring. However, failover does not occur when ethernet1/2 goes down. What is the likely reason?

Accepted Answer

'link-monitoring' is configured under the high-availability hierarchy but not explicitly enabled. In Palo Alto Networks HA configuration, link monitoring is not enabled by default even when the 'link-monitoring' block is present under the 'high-availability' hierarchy. The engineer must explicitly set 'enabled yes' within the 'link-monitoring' configuration to activate it. Without this explicit enable, the firewall will not monitor the specified interfaces for link state changes, so a failure on ethernet1/2 will not trigger a failover.

Answer

The HA group-id is not unique in the network

Answer

HA2 link is down preventing failover

Answer

Path monitoring interval is set too high, causing delayed failover