PCNSA Device Management and Services Practice Question

Exhibit

Refer to the exhibit.
admin@PA-500> show system state | match "ntp|time"
ntp-config:
  ntp-servers {
    primary-ntp-server {
      address: pool.ntp.org;
    }
    secondary-ntp-server {
      address: time.google.com;
    }
  }
  ntp-admin-state: enabled;
  ntp-sync-state: sync;
time-config:
  timezone: America/New_York;
  current-time: 2025-03-15 14:30:22;

After a firewall upgrade, the system clock shows a time that is five minutes behind the actual time, even though NTP is synchronized. What is the most likely cause?

⚠ Common exam trap

Many candidates assume NTP synchronization guarantees correct local time, but they overlook that the timezone offset must be independently configured; Palo Alto Networks tests this by presenting a scenario where NTP is synchronized yet the displayed time is wrong, leading to confusion between NTP server issues and timezone configuration errors.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The timezone offset is incorrectly set.

When NTP is synchronized but the system clock is offset by a fixed amount (e.g., five minutes), the most likely cause is an incorrect timezone offset. NTP synchronizes the UTC time, and the firewall then applies the configured timezone offset to display the local time. If the offset is wrong, the displayed time will be consistently off by that offset value, even though NTP shows synchronization.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The firewall is using a stratum 2 server that is inaccurate.
Why it's wrong here
The exhibit shows standard public servers; they are accurate.
✓
The timezone offset is incorrectly set.
Why this is correct
A wrong timezone would cause the displayed local time to differ from UTC, even if NTP is synced.
✗
NTP authentication is not configured.
Why it's wrong here
Authentication does not affect time accuracy.
✗
The NTP admin state is enabled but the service route is misconfigured.
Why it's wrong here
If the service route were misconfigured, the sync state would not be 'sync'.

Go deeper

PCNSA Device Management and Services Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question