PCNSE Managing Troubleshooting and High Availability — Timed 20 Questions

Question 1

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. During a failover test, the passive firewall becomes active, but traffic stops passing through the new active firewall. The management interface on the new active firewall is reachable. What is the most likely cause?

Accepted Answer

The session setup rate exceeded the new active firewall's capacity.. Option D is correct because when a passive firewall becomes active, it must process all new session setups from scratch. If the session setup rate exceeds the new active firewall's capacity (e.g., due to licensing limits on session count or throughput), traffic will be dropped even though the management interface remains reachable. The management plane is separate from the data plane, so management access can still work while forwarding fails.

Answer

The ARP table was not synchronized during failover.

Answer

The HA2 link is down, causing session table mismatch.

Answer

The new active firewall does not have a valid license.

Question 2

A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?

Accepted Answer

Active/Active. In an active/passive HA pair, only one firewall should be active at a time. When both firewalls show as 'active', this is known as a split-brain condition. It occurs when the HA heartbeat link fails and each firewall assumes the other is down, causing both to transition to the active state and process traffic independently.

Answer

Link failure

Answer

Passive/Passive

Answer

Split brain

Question 3

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

Accepted Answer

Floating static routes were not configured on the passive firewall.. In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.

Answer

Static routes were not synchronized.

Answer

OSPF routes were not synchronized.

Answer

BGP routes were not synchronized.

Question 4

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

Accepted Answer

Enable session sync on HA2.. Option D is correct because enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Answer

Configure HA3 for stateful inspection.

Answer

Increase HA1 keepalive timer.

Answer

Enable config sync on HA1.

Question 5

Which TWO conditions can cause an HA pair to enter an 'active/active' state? (Choose two.)

Accepted Answer

Loss of HA keepalive on both sides. A is correct because when both firewalls lose the HA keepalive (sent over HA1 link), each firewall assumes the peer is dead and transitions to active state to ensure traffic continuity. This is a fail-safe mechanism: without keepalive, each unit independently becomes active, resulting in an active/active condition that can cause duplicate IP addresses and traffic loops.

Answer

License expiration on one firewall

Answer

Session synchronization failure

Answer

Configuration mismatch between peers

Question 6

Based on the exhibit, what caused the last failover?

Accepted Answer

The HA1 keepalive from the peer was lost.. The exhibit shows 'HA1 keepalive from the peer was lost' as the last failover reason. In an active/passive HA pair, the passive firewall monitors HA1 keepalive messages from the active peer. When these keepalives are not received within the configured hello interval (default 1 second) and hold timer (default 3 seconds), the passive firewall assumes the active peer has failed and initiates a failover to become active.

Answer

The HA2 link went down.

Answer

A preemption event occurred.

Answer

The peer firewall was rebooted.

Question 7

A large enterprise uses an active/passive HA pair of PA-5250 firewalls to secure their data center. The network team recently migrated from a flat network to a VXLAN-based overlay. After the migration, they notice that during failover tests, the new active firewall does not forward traffic for VXLAN-terminated VLANs, even though the physical interfaces are up and the HA state transitions correctly. The configuration uses subinterfaces on Ethernet1/1 for each VLAN, with VXLAN tunnel termination on the firewall. The passive firewall receives the configuration sync, but show vxlan tunnel shows no VXLAN tunnels on the new active firewall after failover. The sessions are synced via HA2. The ARP table is correct. Which course of action should the engineer take to resolve the issue?

Accepted Answer

Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall.. Option D is correct because VXLAN tunnels on Palo Alto Networks firewalls are dynamically established based on data-plane traffic. After a failover, the new active firewall does not automatically rebuild the tunnels; it requires traffic to trigger the tunnel establishment. Sending a small amount of traffic through each VXLAN tunnel forces the firewall to initiate the VXLAN tunnel setup, populating the 'show vxlan tunnel' output and restoring traffic forwarding.

Answer

Add static routes for the VXLAN tunnel endpoints on the passive firewall.

Answer

Enable VXLAN tunnel synchronization under HA setup.

Answer

Reboot the new active firewall to reload the VXLAN configuration.

Question 8

A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?

Accepted Answer

Perform a configuration synchronization from the original active firewall.. Option C is correct because the most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.

Answer

Enable preemption on the HA configuration.

Answer

Re-apply the licenses on the newly active firewall.

Answer

Disable the HA2 link to force stateful failover.

Question 9

Refer to the exhibit. An active/active HA pair shows the local firewall as active-secondary. The last failover reason is 'path-group-down'. What should the administrator investigate first?

Accepted Answer

Verify the link status of interface ethernet1/2 and its association with the path monitoring group.. The 'path-group-down' failover reason indicates that the firewall detected a failure in a monitored path group, which is associated with specific interfaces. Option B is correct because the administrator should first verify the link status of interface ethernet1/2 and its association with the path monitoring group, as this directly addresses the root cause of the failover trigger. Path monitoring is used to detect upstream connectivity loss and can cause a firewall to transition to active-secondary if the monitored path fails.

Answer

Inspect the session table for asymmetric routing between the firewalls.

Answer

Ensure the HA2 link is properly connected and firewalls can synchronize sessions.

Answer

Check the HA priority settings to ensure the local firewall should be active-secondary.

Question 10

A network engineer needs to troubleshoot why a specific user cannot access a web application through a Palo Alto Networks firewall. The engineer has verified that the user's traffic reaches the firewall and that no security policy explicitly blocks the traffic. Which CLI command should be used to check if the traffic is being matched by a hidden or implicit rule?

Accepted Answer

test security-policy-match source destination destination-port protocol . Option C, 'test security-policy-match', is the correct command because it simulates a packet against the firewall's security policy rulebase, including any hidden or implicit rules (such as the default intra-zone allow or inter-zone deny rules). This allows the engineer to see exactly which rule the traffic matches, even if no explicit policy is configured, which is essential for troubleshooting implicit rule behavior.

Answer

show session all

Answer

debug dataplane packet-diag

Answer

show running security-policy

Question 11

Arrange the steps to enable and configure GlobalProtect on a Palo Alto Networks firewall.

Question 12

Match each CLI command to its function.

Question 13

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. Option C is correct because by default, management interface failure does not trigger a failover. Option A is wrong because HA1 keepalive failure would trigger failover. Option B is wrong because HA2 link down would trigger if configured. Option D is wrong because session synchronization failure does not cause failover.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 14

After upgrading the software on an HA pair, the two firewalls report different HA states. Which command should be used to quickly verify the HA configuration synchronization status?

Accepted Answer

show high-availability sync-status. Option B is correct because 'show high-availability sync-status' displays the configuration sync state. Option A shows general HA state, not sync. Option C shows pending changes. Option D shows HA2 link status.

Answer

show high-availability pending-changes

Answer

show high-availability state

Answer

show high-availability link-monitoring

Question 15

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. Option A is correct because a dedicated physical interface for HA1 ensures reliable heartbeat. Option B is wrong because using VLAN over data interface adds latency and risk. Option C is wrong because management interface is not recommended due to traffic load. Option D is wrong because HA2 is for data sync, not heartbeat.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 16

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

Accepted Answer

Increase the HA keepalive failover threshold to tolerate temporary packet loss. Option D is correct because HA keepalive failover threshold with a higher value (more missed packets) reduces false failovers. Option A is wrong because session sync does not prevent split-brain. Option B is wrong because increasing hello interval would cause faster failover, not slower. Option C is wrong because link monitoring does not address split-brain from temporary outage.

Answer

Decrease the HA1 hello interval

Answer

Enable link monitoring on all interfaces

Answer

Increase the session synchronization rate

Question 17

After a failover event, some user sessions are reset. The HA pair is configured for Active/Active with session distribution using a hash algorithm. What is the most likely reason for session resets?

Accepted Answer

Session synchronization is not configured between the HA peers. Option B is correct because in Active/Active, stateful failover requires session sync; if not enabled, sessions are not preserved. Option A is wrong because session offload is not a standard feature. Option C is wrong because route redistribution does not cause session resets. Option D is wrong because Packet Buffer Protection affects drop behavior, not session state.

Answer

Session offload is not enabled on the passive firewall

Answer

Packet Buffer Protection threshold was exceeded

Answer

The routing table is not redistributed after failover

Question 18

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. Option A is correct because the first step is to check the HA1 link connectivity, as config sync uses HA1. Option B is wrong because HA2 is for data sync. Option C is wrong because after checking connectivity. Option D is wrong because preempt is about active/passive role.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 19

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. Option C is correct because 'request high-availability sync-to-remote' pushes the active config to the passive, resolving the mismatch. Option A is wrong because that would clear state but not sync config. Option B is wrong because it would disrupt traffic. Option D is wrong because it's not a software upgrade issue.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version

Question 20

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

Accepted Answer

Adjust the session distribution algorithm to match traffic patterns. Option B is correct because Active/Active uses a distribution function (like IP hash) to assign sessions to a firewall; optimizing the hash algorithm for traffic profile reduces asymmetry. Option A is wrong because session syncing all sessions would increase load. Option C is wrong because passive mode defeats purpose. Option D is wrong because link aggregation does not solve session distribution.

Answer

Change the HA mode to Active/Passive

Answer

Increase the HA2 link bandwidth using link aggregation

Answer

Enable session synchronization for all sessions