PCNSA Device Management and Services Practice Question
An administrator notices that the firewall's web interface is accessible via HTTPS but shows an expired certificate warning. The firewall's management certificate was issued by an internal CA and has a validity of two years. The administrator checks the certificate and sees it expired yesterday. The administrator generates a new self-signed certificate through the firewall's GUI. After generating, the administrator assigns the new certificate to the HTTPS management interface. Despite this, the firewall still presents the old expired certificate when accessed. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume GUI assignments take effect immediately, overlooking the mandatory commit step required for all configuration changes on Palo Alto firewalls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new certificate was not committed.
In Palo Alto Networks firewalls, changes to management interface settings, including certificate assignments, require a commit operation to become active. Generating and assigning the new certificate through the GUI only stages the change; without a commit, the firewall continues to use the previously committed configuration, which still references the expired certificate. This is why the old certificate persists despite the assignment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall must be restarted for the change to take effect.
Why it's wrong here
A commit is sufficient; restart not needed.
- ✓
The new certificate was not committed.
Why this is correct
Committing is required to apply the new certificate.
- ✗
The old certificate is still bound to a different service.
Why it's wrong here
HTTPS management uses only one certificate.
- ✗
The browser has cached the old certificate.
Why it's wrong here
Browser cache can be cleared; the firewall should serve the new cert after commit.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 516 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.