PCNSA Device Management and Services Practice Question
An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?
⚠ Common exam trap
Test-takers frequently assume a single log forwarding profile can be assigned to multiple log types with different server destinations, but Palo Alto requires separate profiles to achieve selective routing, as a single profile applies all its servers to all logs it covers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.
Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.
Why this is correct
Correct: Separate profiles allow different log types to be sent to different destinations.
- ✗
Use the default log forwarding settings and configure the syslog servers globally.
Why it's wrong here
Incorrect: Default forwarding sends all logs to all configured servers, lacking granularity.
- ✗
Create a single log forwarding profile with both syslog profiles and assign it to all rules.
Why it's wrong here
Incorrect: A single profile sends all logs to both destinations, which would send traffic logs to the alert syslog as well.
- ✗
Configure each firewall rule to specify which syslog server to send logs to.
Why it's wrong here
Incorrect: Rules don't specify syslog servers; log forwarding profiles are used.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.