PCNSE Managing Troubleshooting and High Availability — Timed 25 Questions

Question 1

Based on the exhibit, what is the impact of the current HA state on the network?

Accepted Answer

Sessions will not be preserved during a failover. The HA2 link is down, which prevents session synchronization. Therefore, sessions will not be preserved during a failover. Option A is incorrect because HA1 is up, so control traffic (configuration synchronization) works. Option B is incorrect because preemptive is disabled; configuration sync is not relevant to preemption. Option D is incorrect because HA1 is up, meaning the HA pair can still perform failover based on link monitoring, but sessions will not be preserved.

Answer

Configuration changes are not synchronized

Answer

The passive firewall will preempt the active when the active fails

Answer

The HA pair cannot perform a failover

Question 2

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. During a failover test, the passive firewall becomes active, but traffic stops passing through the new active firewall. The management interface on the new active firewall is reachable. What is the most likely cause?

Accepted Answer

The session setup rate exceeded the new active firewall's capacity.. When a passive firewall becomes active, it must process all new session setups from scratch. If the session setup rate exceeds the new active firewall's capacity (e.g., due to licensing limits on session count or throughput), traffic will be dropped even though the management interface remains reachable. The management plane is separate from the data plane, so management access can still work while forwarding fails.

Answer

The ARP table was not synchronized during failover.

Answer

The HA2 link is down, causing session table mismatch.

Answer

The new active firewall does not have a valid license.

Question 3

A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?

Accepted Answer

Split brain. In a Palo Alto Networks active/passive HA configuration, if the heartbeat fails, both firewalls assume the other is down and both transition to 'active' state. This unintended condition is called split brain. It is not a valid configuration like Active/Active, which is intentionally configured and requires separate virtual routers or security zones.

Answer

Link failure

Answer

Active/Active

Answer

Passive/Passive

Question 4

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

Accepted Answer

Floating static routes were not configured on the passive firewall.. In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.

Answer

Static routes were not synchronized.

Answer

OSPF routes were not synchronized.

Answer

BGP routes were not synchronized.

Question 5

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

Accepted Answer

Enable session sync on HA2.. Enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Answer

Configure HA3 for stateful inspection.

Answer

Increase HA1 keepalive timer.

Answer

Enable config sync on HA1.

Question 6

Which TWO conditions can cause an HA pair to enter an 'active/active' state? (Choose two.)

Accepted Answer

Loss of HA keepalive on both sides. A is correct because when both firewalls lose the HA keepalive (sent over HA1 link), each firewall assumes the peer is dead and transitions to active state to ensure traffic continuity. This is a fail-safe mechanism: without keepalive, each unit independently becomes active, resulting in an active/active condition that can cause duplicate IP addresses and traffic loops.

Answer

License expiration on one firewall

Answer

Session synchronization failure

Answer

Configuration mismatch between peers

Question 7

Based on the exhibit, what caused the last failover?

Accepted Answer

The HA1 keepalive from the peer was lost.. The exhibit shows 'HA1 keepalive from the peer was lost' as the last failover reason. In an active/passive HA pair, the passive firewall monitors HA1 keepalive messages from the active peer. When these keepalives are not received within the configured hello interval (default 1 second) and hold timer (default 3 seconds), the passive firewall assumes the active peer has failed and initiates a failover to become active.

Answer

The HA2 link went down.

Answer

A preemption event occurred.

Answer

The peer firewall was rebooted.

Question 8

A large enterprise uses an active/passive HA pair of PA-5250 firewalls to secure their data center. The network team recently migrated from a flat network to a VXLAN-based overlay. After the migration, they notice that during failover tests, the new active firewall does not forward traffic for VXLAN-terminated VLANs, even though the physical interfaces are up and the HA state transitions correctly. The configuration uses subinterfaces on Ethernet1/1 for each VLAN, with VXLAN tunnel termination on the firewall. The passive firewall receives the configuration sync, but show vxlan tunnel shows no VXLAN tunnels on the new active firewall after failover. The sessions are synced via HA2. The ARP table is correct. Which course of action should the engineer take to resolve the issue?

Accepted Answer

Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall.. VXLAN tunnels on Palo Alto Networks firewalls are dynamically established based on data-plane traffic. After a failover, the new active firewall does not automatically rebuild the tunnels; it requires traffic to trigger the tunnel establishment. Sending a small amount of traffic through each VXLAN tunnel forces the firewall to initiate the VXLAN tunnel setup, populating the 'show vxlan tunnel' output and restoring traffic forwarding.

Answer

Add static routes for the VXLAN tunnel endpoints on the passive firewall.

Answer

Enable VXLAN tunnel synchronization under HA setup.

Answer

Reboot the new active firewall to reload the VXLAN configuration.

Question 9

A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?

Accepted Answer

Perform a configuration synchronization from the original active firewall.. The most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.

Answer

Enable preemption on the HA configuration.

Answer

Re-apply the licenses on the newly active firewall.

Answer

Disable the HA2 link to force stateful failover.

Question 10

Refer to the exhibit. An active/active HA pair shows the local firewall as active-secondary. The last failover reason is 'path-group-down'. What should the administrator investigate first?

Accepted Answer

Verify the link status of interface ethernet1/2 and its association with the path monitoring group.. The 'path-group-down' failover reason indicates that the firewall detected a failure in a monitored path group, which is associated with specific interfaces. Option B is correct because the administrator should first verify the link status of interface ethernet1/2 and its association with the path monitoring group, as this directly addresses the root cause of the failover trigger. Path monitoring is used to detect upstream connectivity loss and can cause a firewall to transition to active-secondary if the monitored path fails.

Answer

Inspect the session table for asymmetric routing between the firewalls.

Answer

Ensure the HA2 link is properly connected and firewalls can synchronize sessions.

Answer

Check the HA priority settings to ensure the local firewall should be active-secondary.

Question 11

A network engineer needs to troubleshoot why a specific user cannot access a web application through a Palo Alto Networks firewall. The engineer has verified that the user's traffic reaches the firewall and that no security policy explicitly blocks the traffic. Which CLI command should be used to check if the traffic is being matched by a hidden or implicit rule?

Accepted Answer

test security-policy-match source destination destination-port protocol . 'test security-policy-match', is the correct command because it simulates a packet against the firewall's security policy rulebase, including any hidden or implicit rules (such as the default intra-zone allow or inter-zone deny rules). This allows the engineer to see exactly which rule the traffic matches, even if no explicit policy is configured, which is essential for troubleshooting implicit rule behavior.

Answer

show session all

Answer

debug dataplane packet-diag

Answer

show running security-policy

Question 12

Arrange the steps to enable and configure GlobalProtect on a Palo Alto Networks firewall.

Accepted Answer

First configure the GlobalProtect portal, then configure the GlobalProtect gateway, then configure the GlobalProtect agent (client configuration), and finally configure security policies.. The correct sequence for enabling and configuring GlobalProtect on a Palo Alto Networks firewall starts with configuring the portal, which handles authentication and client settings. Next, the gateway is configured to manage VPN connections. Then, the GlobalProtect agent (client configuration) is set up to push settings to endpoints. Finally, security policies are applied to allow GlobalProtect traffic. Following this order ensures dependencies are satisfied and reduces configuration errors.

Answer

First configure the GlobalProtect gateway, then configure the GlobalProtect portal, then configure the GlobalProtect agent, and finally configure security policies.

Answer

First configure the GlobalProtect agent, then configure the GlobalProtect portal, then configure the GlobalProtect gateway, and finally configure security policies.

Answer

First configure security policies, then configure the GlobalProtect portal, then configure the GlobalProtect gateway, and finally configure the GlobalProtect agent.

Question 13

Match each CLI command to its function.

Accepted Answer

show system info: Displays system information including uptime, model, and software version.. These are common commands used in PAN-OS CLI. Correct matches are: show system info shows system information, request restart system restarts the system, show running configuration shows the current config. 'request commit' commits changes, and 'show interface all' shows interfaces.

Answer

request commit: Displays the current running configuration.

Answer

show interface all: Restarts the system or a specific component.

Question 14

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

Accepted Answer

Management interface failure is not a monitored condition by default. In an Active/Passive HA pair, the passive firewall monitors the active firewall's liveness via the HA1 control link. By default, only the HA1 link failure triggers a failover; the management interface is not monitored for HA state transitions. Therefore, if the management interface goes down but the HA1 link remains up, the passive firewall does not detect a failure and will not become active.

Answer

HA1 keepalive failure is not detected

Answer

HA2 link monitoring is not enabled

Answer

Session synchronization is not complete

Question 15

After upgrading the software on an HA pair, the two firewalls report different HA states. Which command should be used to quickly verify the HA configuration synchronization status?

Accepted Answer

show high-availability sync-status. The 'show high-availability sync-status' command specifically displays the synchronization status of the configuration between HA peers, including whether the active and passive firewalls are in sync, the last sync time, and any pending changes. After a software upgrade, configuration mismatches can occur due to version differences or failed syncs, and this command directly verifies if the configurations are synchronized.

Answer

show high-availability pending-changes

Answer

show high-availability state

Answer

show high-availability link-monitoring

Question 16

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

Accepted Answer

Use a dedicated physical interface for HA1, not shared with data traffic. The HA1 control link carries critical heartbeat and synchronization traffic between the two firewalls in an active/passive or active/active HA pair. Using a dedicated physical interface ensures that control traffic is isolated from data traffic, preventing congestion or interference that could cause false failovers or synchronization delays. The management interface (MGT) is not recommended for HA1 because it shares the control plane CPU and can be overwhelmed by management traffic, leading to HA instability.

Answer

Use the management interface (MGT) for HA1

Answer

Configure HA1 as a subinterface on the HA2 link

Answer

Configure HA1 over a VLAN on a data interface to save ports

Question 17

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

Accepted Answer

Increase the HA keepalive failover threshold to tolerate temporary packet loss. Increasing the HA keepalive failover threshold allows the firewalls to tolerate a brief network outage without triggering a split-brain scenario. By requiring more missed heartbeats before declaring the peer dead, the firewalls avoid both becoming active simultaneously due to transient packet loss. This directly addresses the root cause—premature failover during temporary connectivity issues.

Answer

Decrease the HA1 hello interval

Answer

Enable link monitoring on all interfaces

Answer

Increase the session synchronization rate

Question 18

After a failover event, some user sessions are reset. The HA pair is configured for Active/Active with session distribution using a hash algorithm. What is the most likely reason for session resets?

Accepted Answer

Session synchronization is not configured between the HA peers. In an Active/Active HA pair with session distribution based on a hash algorithm, each firewall handles a subset of traffic flows. Without session synchronization between the peers, the backup firewall has no session table entries for flows hashed to the primary. After a failover, the backup firewall sees these packets as new connections and resets them because it lacks the state information required to continue the existing sessions.

Answer

Session offload is not enabled on the passive firewall

Answer

Packet Buffer Protection threshold was exceeded

Answer

The routing table is not redistributed after failover

Question 19

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

Accepted Answer

Verify HA1 link status and IP connectivity between peers. The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Answer

Disable preemption on the active firewall

Answer

Check the HA2 link session synchronization status

Answer

Reboot both firewalls to clear the failure

Question 20

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

Accepted Answer

Run 'request high-availability sync-to-remote' from the active firewall. The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.

Answer

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Answer

Failover the active firewall to force re-sync

Answer

Upgrade both firewalls to the same PAN-OS version