PCNSE Managing Troubleshooting and High Availability Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. Based on the log, what triggered the failover?

Accepted Answer

A path monitoring group determined that the upstream ISP is unreachable. The log entry indicates that the failover was triggered by a path monitoring group, which detected that the upstream ISP became unreachable. Path monitoring actively probes the next-hop gateway or a target IP address; when the probe fails, the firewall considers the path down and initiates a failover to the passive peer. This is distinct from HA1 heartbeat loss or link failure, as the log explicitly references the path monitoring group.

Answer

Loss of HA1 heartbeat from the peer

Answer

A link failure on ethernet1/1

Answer

An administrator manually triggered a failover

Question 2

In an HA active/passive setup, the engineer wants to ensure that during a failover, existing FTP data sessions are not interrupted. What additional configuration is required beyond default session synchronization?

Accepted Answer

Configure an application layer gateway (ALG) for FTP. FTP uses separate control and data channels, and the data channel port is dynamically negotiated via the PORT or PASV command. Without an application layer gateway (ALG) for FTP, the firewall cannot track these dynamic ports, so session synchronization would only replicate the control session, causing data sessions to drop after a failover. Enabling the FTP ALG ensures the firewall inspects FTP commands and creates the necessary pinholes for data sessions, which are then synchronized to the passive peer.

Answer

Use HA3 link for session synchronization

Answer

Enable asymmetric routing support

Answer

Enable UDP session synchronization

Question 3

An administrator needs to verify the health of HA links. Which CLI command displays the current status of HA1, HA2, and HA3 links?

Accepted Answer

show high-availability state. The 'show high-availability state' command is the correct CLI command to verify the health of HA1, HA2, and HA3 links because it displays the current status, link state, and any failures for each HA link in a Palo Alto Networks firewall. This command provides a comprehensive view of the HA control link (HA1), data link (HA2), and backup link (HA3), including their operational status and packet statistics, which is essential for troubleshooting high-availability configurations.

Answer

show session info

Answer

show running np-ips

Answer

show device-info

Question 4

A firewall in an HA pair is being upgraded. The administrator wants to minimize traffic loss. What is the recommended procedure for upgrading the passive firewall in an active/passive pair?

Accepted Answer

Upgrade the passive firewall, failover to it, then upgrade the original active. In an active/passive HA pair, the passive firewall is upgraded first while the active firewall continues to handle traffic. After the passive firewall is upgraded and rebooted, an administrative failover is performed to make it the new active firewall, minimizing traffic loss. The original active firewall is then upgraded, ensuring there is always a firewall processing traffic during the upgrade process.

Answer

Upgrade the active firewall first, then failover to the passive

Answer

Suspend HA, upgrade both, then re-enable HA

Answer

Upgrade both firewalls simultaneously after disconnecting HA links

Question 5

During a network incident, an engineer notices that after an HA failover, some sessions are not active on the new active firewall. The 'show session all' command shows the sessions with state 'half-closed'. What is the most likely cause?

Accepted Answer

The firewall failed to properly synchronize the TCP sessions before the failover. The 'half-closed' session state indicates that the firewall has only one side of the TCP handshake (FIN or RST) recorded, which typically occurs when session synchronization fails during an HA failover. In an active/passive HA pair, TCP session state information is synchronized via the HA2 link; if synchronization is incomplete or interrupted before the failover, the new active firewall will have partial session data, leading to half-closed sessions. This is a common symptom of a synchronization failure, not a timeout or routing issue.

Answer

The HA2 link failover timer is set too low

Answer

The ARP timeout on the next-hop router is too short

Answer

Asymmetric routing is causing the firewall to see only one direction of traffic

Question 6

Which TWO statements about active/active HA mode are true compared to active/passive mode? (Choose two.)

Accepted Answer

Active/active requires enabling asymmetric routing support. In active/active HA mode, both firewalls can process traffic simultaneously, which requires enabling asymmetric routing support to handle traffic that may arrive at either firewall for the same session. This is necessary because active/active mode does not enforce a single path for traffic, unlike active/passive mode where only one firewall actively processes traffic.

Answer

Active/active eliminates the need for failover

Answer

Active/active automatically synchronizes configuration changes

Answer

Active/active is the default and most commonly deployed mode

Question 7

Based on the exhibit, what is the impact of the current HA state on the network?

Accepted Answer

Sessions will not be preserved during a failover. The exhibit shows that the HA pair's session synchronization is not synchronized (for example, the HA2 data link is down or session synchronization is disabled). In active/passive HA, session preservation requires session synchronization. Because sessions are not synchronized between the peers, a failover will drop existing sessions, so sessions will not be preserved.

Answer

Configuration changes are not synchronized

Answer

The passive firewall will preempt the active when the active fails

Answer

The HA pair cannot perform a failover

Question 8

Based on the exhibit, what is the most likely cause of the warnings?

Accepted Answer

Both the primary and backup HA2 links are down. The exhibit shows warnings indicating that both the primary and backup HA2 links are down. HA2 is the control link used for session synchronization and configuration state exchange in an active/passive or active/active firewall pair. When both HA2 links fail, the firewalls cannot synchronize session tables, leading to warnings about potential asymmetric traffic and failover issues. Option C correctly identifies this as the most likely cause.

Answer

The HA3 link is misconfigured

Answer

Configuration synchronization is failing

Answer

The HA2 keepalive timer is set too low

Question 9

A medium-sized enterprise has two Palo Alto Networks PA-5250 firewalls configured in an active/passive HA pair with session synchronization and configuration synchronization enabled. The HA1 link is a direct copper cable, and the HA2 link is also a direct copper cable. The firewalls are connected to two upstream routers (R1 and R2) and two downstream switches (S1 and S2). The network uses OSPF for dynamic routing. The active firewall (FW-A) is connected to R1 and S1, while the passive firewall (FW-P) is connected to R2 and S2. The OSPF cost is set symmetrically on both sides. During a maintenance window, the network team shuts down the HA1 and HA2 links on both firewalls to test failover behavior. After the links are brought back up, the firewalls are in a state of 'non-functional' and 'suspended'. The team suspects the HA configuration is broken. What is the most likely cause and the best course of action to restore HA?

Accepted Answer

Reboot both firewalls after verifying the HA configuration and that the links are operationally up. When both HA1 and HA2 links are simultaneously shut down on both firewalls, the active/passive pair loses all communication and session synchronization. Upon restoration, the firewalls enter a 'non-functional' and 'suspended' state because the HA control plane cannot re-establish a quorum or verify the peer's state without a full reset of the HA state machine. Rebooting both firewalls after verifying the HA configuration and that the links are operationally up forces a clean initialization of the HA process, clearing the suspended state and allowing the pair to renegotiate roles correctly.

Answer

Upgrade both firewalls to the same software version and then re-initialize HA

Answer

Change the HA mode to active/active and enable asymmetric routing

Answer

Configure a dedicated management interface for HA1 communication and ensure HA2 is on a different subnet

Question 10

An organization has configured an active/passive high availability pair of Palo Alto Networks firewalls. During a maintenance window, the active firewall was rebooted. After the reboot, the passive firewall became active, but the session table on the original active firewall is incomplete. The administrator notices that session synchronization is not working properly. Which two configuration checks should the technician perform to resolve this issue?

Accepted Answer

Verify that the HA2 link is operational and has sufficient bandwidth.. Session synchronization in an active/passive HA pair uses the HA2 link (or HA2 backup) to replicate session tables between firewalls. If the HA2 link is down, has insufficient bandwidth, or is misconfigured, session synchronization will fail, causing the newly active firewall to have an incomplete session table after a failover. Verifying that the HA2 link is operational and has sufficient bandwidth is therefore a critical first step in troubleshooting this issue.

Answer

Check that the session synchronization encryption is disabled to reduce latency.

Answer

Validate that the heartbeat hold timer is set to a value greater than the failover delay.

Answer

Confirm that the HA1 link is using the correct IP address and is in the same subnet.

Question 11

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

Accepted Answer

Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.. Configuring the HA mode with the 'preemptive' option ensures that when both firewalls recover from a power outage, the firewall with the higher device priority (the intended active unit) will automatically preempt the other and become active. Without preemption, both firewalls may come up as active if they lose HA heartbeat synchronization during the outage, leading to a split-brain scenario. Setting the device priority higher on FW-A guarantees it is preferred as the active unit upon recovery.

Answer

Reboot both firewalls simultaneously to reset the HA state.

Answer

Disable link speed and duplex settings on the HA interfaces to force a failover.

Answer

Set the HA mode to 'active/active' to allow both firewalls to process traffic.

Question 12

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

Accepted Answer

Link monitoring is enabled but not configured to monitor the specific interface that failed.. Link monitoring on a Palo Alto Networks firewall is configured to monitor specific interfaces. If the upstream link that failed is not included in the link monitoring group, the passive firewall will not detect the loss of that link and will not trigger a failover. The passive firewall only monitors the interfaces explicitly listed under Device > High Availability > Link Monitoring, so an unmonitored interface failure will be ignored for HA purposes.

Answer

HA2 heartbeat link is down, preventing the passive from detecting the active's failure.

Answer

The fail-holdup timer is set to 0, causing immediate failover but not triggered.

Answer

Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.

Question 13

A network security engineer is troubleshooting a Palo Alto Networks firewall that is dropping traffic to a critical internal server. The engineer runs 'show session all filter destination 10.1.1.50' and sees sessions in the 'discard' state. The engineer wants to determine why these sessions are being discarded. Which action should the engineer take next?

Accepted Answer

Run 'show session id <session-id>' to view detailed session information including the discard reason.. The 'show session id' command provides detailed session information, including the discard reason, which is essential for troubleshooting why sessions are in the discard state. The other commands either provide aggregate data or require additional steps to correlate with the specific session, making them less efficient for this scenario.

Answer

Run 'show running resource-monitor' to check if the firewall is under resource stress.

Answer

Run 'show counter global filter severity drop' to identify the global counters that are incrementing.

Answer

Run 'debug dataplane packet-diag set filter match destination 10.1.1.50' to capture packets and analyze them.

Question 14

During a failover test, the active firewall in an active/passive HA pair goes down, but the passive firewall remains in passive state and does not take over. The passive firewall shows HA state 'passive' and the HA1 link status is 'down'. What is the most likely cause?

Accepted Answer

The HA1 link is down, preventing heartbeat communication.. The HA1 link is critical for heartbeats and control communication. When it is down, the passive firewall cannot determine the active firewall's status and will not initiate failover. The stem indicates HA1 link status is 'down', which directly explains why the passive firewall remains passive despite the active firewall going down.

Answer

The HA2 link is not configured for session synchronization.

Answer

The HA1 link is not configured with the same subnet on both firewalls.

Answer

The passive firewall is configured with a lower HA priority.

Question 15

A security engineer is configuring HA on a pair of Palo Alto Networks firewalls. The engineer wants to ensure that the HA1 control link is highly available. Which configuration should the engineer use for the HA1 link?

Accepted Answer

Use an HA1 backup link in addition to the primary HA1 link.. The HA1 control link is critical for HA communication. To ensure high availability, a backup HA1 link should be configured. This allows the firewalls to maintain HA state synchronization even if the primary HA1 link fails. Other options may provide a working link but do not offer redundancy for the link itself.

Answer

Use a dedicated physical interface connected to a switch with redundant paths.

Answer

Use an IP-bridged HA1 link over a dedicated physical interface.

Answer

Use a dedicated physical interface with a direct cable between the firewalls.