mediumMultiple ChoiceObjective-mapped
PCNSA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. admin@PA-500> show counter global | match tcp tcp-conn-init 1500 tcp-conn-established 1200 tcp-conn-closed 1400 tcp-conn-failed 200 tcp-conn-reset 100 tcp-conn-half-open 50 tcp-conn-timeout 30
Refer to the exhibit. A firewall administrator is troubleshooting a performance issue. The number of half-open TCP connections is unusually high. What is a likely cause?
⚠ Common exam trap
The trap here is that candidates often associate high half-open connections exclusively with DDoS SYN floods, but the question specifically asks for a 'likely cause' given the context of a performance issue, and an internal application misbehavior is a common real-world scenario that does not require an attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An application on the internal network is not completing TCP handshakes.
A high number of half-open TCP connections indicates that SYN packets are received but the three-way handshake is never completed. Option B is correct because an internal application that fails to send the final ACK (or does not respond to SYN-ACK) leaves connections in a half-open state, consuming firewall resources and degrading performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A DDoS attack is flooding the firewall with SYN packets.
Why it's wrong here
SYN flood would show very high tcp-conn-init, not just half-open.
- ✓
An application on the internal network is not completing TCP handshakes.
Why this is correct
Half-open connections indicate incomplete handshakes, likely due to application failure.
- ✗
The firewall's TCP timeout setting is too short.
Why it's wrong here
Short timeouts would reduce half-open count, not increase it.
- ✗
The firewall's hardware is failing.
Why it's wrong here
Hardware failure would show more generic errors, not specific half-open count.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.