PCNSA Device Management and Services Practice Question
A company has deployed a pair of PA-5250 firewalls in an Active/Passive HA configuration. The management network uses a separate subnet with addresses 10.0.0.0/24. The active firewall's management IP is 10.0.0.1, passive is 10.0.0.2. They have a virtual router configured with static routes. The HA configuration uses HA1 (backplane) for heartbeat and HA2 for session sync. After a power failure, both firewalls reboot. The active firewall comes up first and becomes active. The passive firewall later joins, but fails to become passive; it remains in 'non-functional' state. The administrator observes the following: - HA1 link is up on both firewalls. - HA2 link shows 'waiting for HA2 link' on the active. - The passive firewall's management IP is reachable. - The active firewall shows 'peer unreachable' in HA status. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse HA1 and HA2 roles, assuming that if HA1 is up and management is reachable, the HA pair should form, but they overlook that HA2 is mandatory for the passive firewall to exit the 'non-functional' state and become passive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The HA2 cable is faulty or misconfigured
The active firewall shows 'waiting for HA2 link' and 'peer unreachable' despite HA1 being up and the passive management IP being reachable. This indicates that the HA2 link, which is responsible for session synchronization and state propagation, is not functioning. Since HA2 is required for the passive firewall to transition to a passive state, a faulty or misconfigured HA2 cable prevents the passive firewall from becoming operational, leaving it in a 'non-functional' state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The management interface on the passive is misconfigured
Why it's wrong here
Management IP is reachable, so it is correctly configured.
- ✗
The HA1 configuration is missing the peer's management IP
Why it's wrong here
HA1 does not require peer management IP; it uses backplane.
- ✓
The HA2 cable is faulty or misconfigured
Why this is correct
HA2 being in 'waiting for HA2 link' indicates no Layer 1 connectivity.
- ✗
The passive firewall has a different PAN-OS version
Why it's wrong here
Version mismatch would cause a 'version mismatch' error, not HA2 waiting.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.