hardMultiple ChoiceObjective-mapped
PCNSA Practice Question: A large enterprise operates multiple data centers…
A large enterprise operates multiple data centers with a Palo Alto Networks firewall pair in each data center in active/passive HA. The firewalls are managed by Panorama. Recently, after a power outage in Data Center A, both firewalls in that data center came back online but are not passing traffic. The network team confirms that the switches and routers are operational. The Panorama administrator sees that both firewalls are connected and show green in the Managed Devices tab. However, the active firewall in Data Center A shows "HA state: passive" and the other firewall also shows "passive". The administrator suspects a configuration issue. What is the most likely cause and corrective action?
⚠ Common exam trap
Test-takers frequently assume a missing heartbeat interface or a link failure causes both firewalls to be passive, but in reality those scenarios cause split-brain (both active) or HA not forming, not both passive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both firewalls have the same priority and no preemptive is enabled; configure different priorities and enable preemptive.
In an active/passive HA pair, if both firewalls show 'passive', it typically means they cannot determine which should be active. This occurs when both have the same priority and preemptive is disabled, so neither can claim the active role after a reboot. Configuring different priorities and enabling preemptive ensures one firewall becomes active based on its higher priority (lower numerical value).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Both firewalls have the same priority and no preemptive is enabled; configure different priorities and enable preemptive.
Why this is correct
Equal priority with no preemptive causes both to remain passive. Differing priorities with preemptive allow one to become active.
- ✗
The HA firewall link is down; check and reconnect the Layer 2 link between the firewalls.
Why it's wrong here
Link status would be reflected in command output and is unlikely to cause both to be passive.
- ✗
The HA configuration is missing a heartbeat interface; add a dedicated heartbeat interface.
Why it's wrong here
Heartbeat interface absence would show link down issues, not both passive.
- ✗
The preemptive settings are misconfigured; change the priority to make one firewall active.
Why it's wrong here
If priorities are the same, changing one priority may help, but enabling preemptive ensures automatic takeover.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.