PCNSA Device Management and Services Practice Question
A company has a pair of PA-5220 firewalls configured in an active/passive high-availability (HA) cluster. The devices are managed via Panorama, which also manages other firewalls. The security team reports that after a recent commit on Panorama, the passive firewall in the HA pair stops responding to management pings. The active firewall continues to pass traffic and is manageable. Upon investigation, the passive firewall shows the following on its console: 'Management plane is down.' The administrator suspects the passive firewall might have received a configuration that disables the management interface. What should the administrator do to restore management access to the passive firewall without affecting production traffic?
⚠ Common exam trap
Many exam-takers assume a reboot or configuration sync will fix the issue, but they fail to recognize that the passive firewall's management plane is down due to a committed configuration error, requiring console-based recovery to restore management access without disrupting the active firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access the passive firewall via the console port and enter the password recovery mode to reset the management interface configuration.
When the passive firewall's management plane is down and it is unresponsive to management pings, console access is the only way to interact with it. Password recovery mode allows the administrator to reset the management interface configuration without affecting the active firewall or production traffic, as the passive firewall is not forwarding data traffic in an active/passive HA cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
From the active firewall CLI, run 'request high-availability sync-to-remote running-config'.
Why it's wrong here
This would push the active config to passive, but the passive management is down; also the active config may also have the issue.
- ✓
Access the passive firewall via the console port and enter the password recovery mode to reset the management interface configuration.
Why this is correct
Password recovery mode allows resetting management access without affecting other configurations.
- ✗
Disconnect the HA link and reset the passive firewall to factory defaults.
Why it's wrong here
This is too disruptive and not necessary for restoring management access only.
- ✗
Reboot the passive firewall to load the previous running configuration.
Why it's wrong here
Rebooting loads the same configuration; it won't fix the issue.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.