PCNSE Managing Troubleshooting and High Availability Practice Test 3 — 15 Questions

Question 1

An HA pair is configured with active/active mode and session sync enabled. After a failover, a network administrator notices that some new TCP connections fail. The firewall logs show no drops. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric routing is causing the SYN packet to be processed by one firewall and the SYN-ACK by the other. In an active/active HA pair with session sync enabled, asymmetric routing can occur after a failover if the traffic flow changes such that the SYN packet is processed by one firewall and the SYN-ACK by the other. Since session sync only synchronizes established sessions, not half-open ones, the firewall receiving the SYN-ACK does not have a session entry for the SYN, causing it to drop the SYN-ACK as a non-SYN packet without a session. The firewall logs show no drops because the drop occurs at the session lookup stage and may not be logged by default, or the drop counter is not incremented for this specific scenario.

Answer

The ARP cache on the firewalls is stale

Answer

Flow-based routing is misconfigured

Answer

Session synchronization is not functioning for TCP

Question 2

What is the recommended best practice for the HA2 keepalive timer in an active/passive HA configuration?

Accepted Answer

1000 ms. In an active/passive HA configuration, the HA2 keepalive timer should be set to 1000 ms (1 second) as a best practice. This value provides a balance between fast failover detection and network stability, ensuring that the passive firewall can detect a failure of the active firewall within a reasonable timeframe without causing false positives due to transient network issues.

Answer

2000 ms

Answer

It should be left at the default value and not changed

Answer

500 ms

Question 3

An administrator runs 'show high-availability state' and sees that the local firewall is in 'passive' state, but the remote firewall shows 'active'. However, the HA1 link is up and the configuration is synchronized. What could cause the passive firewall to not take over after the active fails?

Accepted Answer

The HA2 link is down. If the HA2 link is down, the passive firewall cannot synchronize session state from the active firewall. In Palo Alto Networks HA implementations, the passive firewall requires a functional HA2 link to be considered fully operational and ready to take over; without it, the passive will not assume the active role even if the active fails. The HA1 link ensures heartbeats and configuration synchronization, but state synchronization over HA2 is critical for failover eligibility.

Answer

The configuration is not synchronized

Answer

Session synchronization is not fully complete

Answer

Preemptive mode is disabled and the passive firewall has a lower priority

Question 4

In an HA active/passive setup, the engineer wants to ensure that during a failover, existing FTP data sessions are not interrupted. What additional configuration is required beyond default session synchronization?

Accepted Answer

Configure an application layer gateway (ALG) for FTP. FTP uses separate control and data channels, and the data channel port is dynamically negotiated via the PORT or PASV command. Without an application layer gateway (ALG) for FTP, the firewall cannot track these dynamic ports, so session synchronization would only replicate the control session, causing data sessions to drop after a failover. Enabling the FTP ALG ensures the firewall inspects FTP commands and creates the necessary pinholes for data sessions, which are then synchronized to the passive peer.

Answer

Use HA3 link for session synchronization

Answer

Enable asymmetric routing support

Answer

Enable UDP session synchronization

Question 5

An administrator needs to verify the health of HA links. Which CLI command displays the current status of HA1, HA2, and HA3 links?

Accepted Answer

show high-availability state. The 'show high-availability state' command is the correct CLI command to verify the health of HA1, HA2, and HA3 links because it displays the current status, link state, and any failures for each HA link in a Palo Alto Networks firewall. This command provides a comprehensive view of the HA control link (HA1), data link (HA2), and backup link (HA3), including their operational status and packet statistics, which is essential for troubleshooting high-availability configurations.

Answer

show session info

Answer

show running np-ips

Answer

show device-info

Question 6

A firewall in an HA pair is being upgraded. The administrator wants to minimize traffic loss. What is the recommended procedure for upgrading the passive firewall in an active/passive pair?

Accepted Answer

Upgrade the passive firewall, failover to it, then upgrade the original active. In an active/passive HA pair, the passive firewall is upgraded first while the active firewall continues to handle traffic. After the passive firewall is upgraded and rebooted, an administrative failover is performed to make it the new active firewall, minimizing traffic loss. The original active firewall is then upgraded, ensuring there is always a firewall processing traffic during the upgrade process.

Answer

Upgrade the active firewall first, then failover to the passive

Answer

Suspend HA, upgrade both, then re-enable HA

Answer

Upgrade both firewalls simultaneously after disconnecting HA links

Question 7

During a network incident, an engineer notices that after an HA failover, some sessions are not active on the new active firewall. The 'show session all' command shows the sessions with state 'half-closed'. What is the most likely cause?

Accepted Answer

The firewall failed to properly synchronize the TCP sessions before the failover. The 'half-closed' session state indicates that the firewall has only one side of the TCP handshake (FIN or RST) recorded, which typically occurs when session synchronization fails during an HA failover. In an active/passive HA pair, TCP session state information is synchronized via the HA2 link; if synchronization is incomplete or interrupted before the failover, the new active firewall will have partial session data, leading to half-closed sessions. This is a common symptom of a synchronization failure, not a timeout or routing issue.

Answer

The HA2 link failover timer is set too low

Answer

The ARP timeout on the next-hop router is too short

Answer

Asymmetric routing is causing the firewall to see only one direction of traffic

Question 8

Which TWO of the following are prerequisites for configuring high availability on Palo Alto Networks firewalls? (Choose two.)

Accepted Answer

Both firewalls must run the same software version. Both firewalls in a high availability (HA) pair must run the same PAN-OS software version to ensure configuration synchronization and stateful failover compatibility. The HA synchronization process uses the HA2 link to replicate configurations and session state, and version mismatches can cause sync failures or unexpected behavior during failover.

Answer

Both firewalls must have management IPs in different subnets

Answer

Both firewalls must have the same interface naming

Answer

Both firewalls must have the same licenses

Question 9

An engineer is troubleshooting an HA pair where session synchronization is not working. Which THREE steps should be taken to diagnose the issue? (Choose three.)

Accepted Answer

Verify that the HA2 link is operationally up. The HA2 link is the dedicated link for session synchronization in a Palo Alto Networks HA pair. If the HA2 link is not operationally up, session state information cannot be exchanged between the firewalls, causing synchronization to fail. Verifying the HA2 link status is a fundamental first step in troubleshooting session sync issues.

Answer

Check the HA1 link status using 'show high-availability state'

Answer

Enable flow-based routing on both firewalls

Question 10

Which TWO statements about active/active HA mode are true compared to active/passive mode? (Choose two.)

Accepted Answer

Active/active requires enabling asymmetric routing support. In active/active HA mode, both firewalls can process traffic simultaneously, which requires enabling asymmetric routing support to handle traffic that may arrive at either firewall for the same session. This is necessary because active/active mode does not enforce a single path for traffic, unlike active/passive mode where only one firewall actively processes traffic.

Answer

Active/active eliminates the need for failover

Answer

Active/active automatically synchronizes configuration changes

Answer

Active/active is the default and most commonly deployed mode

Question 11

Based on the exhibit, what is the most likely cause of the warnings?

Accepted Answer

Both the primary and backup HA2 links are down. The exhibit shows warnings indicating that both the primary and backup HA2 links are down. HA2 is the control link used for session synchronization and configuration state exchange in an active/passive or active/active firewall pair. When both HA2 links fail, the firewalls cannot synchronize session tables, leading to warnings about potential asymmetric traffic and failover issues. Option C correctly identifies this as the most likely cause.

Answer

The HA3 link is misconfigured

Answer

Configuration synchronization is failing

Answer

The HA2 keepalive timer is set too low

Question 12

A medium-sized enterprise has two Palo Alto Networks PA-5250 firewalls configured in an active/passive HA pair with session synchronization and configuration synchronization enabled. The HA1 link is a direct copper cable, and the HA2 link is also a direct copper cable. The firewalls are connected to two upstream routers (R1 and R2) and two downstream switches (S1 and S2). The network uses OSPF for dynamic routing. The active firewall (FW-A) is connected to R1 and S1, while the passive firewall (FW-P) is connected to R2 and S2. The OSPF cost is set symmetrically on both sides. During a maintenance window, the network team shuts down the HA1 and HA2 links on both firewalls to test failover behavior. After the links are brought back up, the firewalls are in a state of 'non-functional' and 'suspended'. The team suspects the HA configuration is broken. What is the most likely cause and the best course of action to restore HA?

Accepted Answer

Reboot both firewalls after verifying the HA configuration and that the links are operationally up. When both HA1 and HA2 links are simultaneously shut down on both firewalls, the active/passive pair loses all communication and session synchronization. Upon restoration, the firewalls enter a 'non-functional' and 'suspended' state because the HA control plane cannot re-establish a quorum or verify the peer's state without a full reset of the HA state machine. Rebooting both firewalls after verifying the HA configuration and that the links are operationally up forces a clean initialization of the HA process, clearing the suspended state and allowing the pair to renegotiate roles correctly.

Answer

Upgrade both firewalls to the same software version and then re-initialize HA

Answer

Change the HA mode to active/active and enable asymmetric routing

Answer

Configure a dedicated management interface for HA1 communication and ensure HA2 is on a different subnet

Question 13

An organization has configured an active/passive high availability pair of Palo Alto Networks firewalls. During a maintenance window, the active firewall was rebooted. After the reboot, the passive firewall became active, but the session table on the original active firewall is incomplete. The administrator notices that session synchronization is not working properly. Which two configuration checks should the technician perform to resolve this issue?

Accepted Answer

Verify that the HA2 link is operational and has sufficient bandwidth.. Session synchronization in an active/passive HA pair uses the HA2 link (or HA2 backup) to replicate session tables between firewalls. If the HA2 link is down, has insufficient bandwidth, or is misconfigured, session synchronization will fail, causing the newly active firewall to have an incomplete session table after a failover. Verifying that the HA2 link is operational and has sufficient bandwidth is therefore a critical first step in troubleshooting this issue.

Answer

Check that the session synchronization encryption is disabled to reduce latency.

Answer

Validate that the heartbeat hold timer is set to a value greater than the failover delay.

Answer

Confirm that the HA1 link is using the correct IP address and is in the same subnet.

Question 14

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

Accepted Answer

Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.. Configuring the HA mode with the 'preemptive' option ensures that when both firewalls recover from a power outage, the firewall with the higher device priority (the intended active unit) will automatically preempt the other and become active. Without preemption, both firewalls may come up as active if they lose HA heartbeat synchronization during the outage, leading to a split-brain scenario. Setting the device priority higher on FW-A guarantees it is preferred as the active unit upon recovery.

Answer

Reboot both firewalls simultaneously to reset the HA state.

Answer

Disable link speed and duplex settings on the HA interfaces to force a failover.

Answer

Set the HA mode to 'active/active' to allow both firewalls to process traffic.

Question 15

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

Accepted Answer

Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.. Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Answer

Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.

Answer

Reboot the passive firewall to attempt to re-establish HA communication.

Answer

Check the logs on the passive firewall for new critical events during the switch replacement.