PCNSE Troubleshoot Practice Question
A company is experiencing intermittent connectivity issues between two branch offices connected via an IPSec tunnel. Users report that they can access resources for a few minutes, then lose connectivity, and after a short time it comes back. Which troubleshooting step should be taken first?
⚠ Common exam trap
The trap here is that candidates often jump to routing or security rule checks, but the periodic nature of the outage is a classic symptom of IPsec SA rekey failure, not a routing or policy issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the IPSec tunnel status and IKE/IPSEC SA rekey timers
The intermittent connectivity pattern (works for a few minutes, drops, then recovers) strongly indicates a phase 2 (IPsec SA) rekey failure. When the IPsec SA lifetime expires and the rekey fails, traffic stops until the SA is re-established, causing the described symptoms. Checking the IKE/IPsec SA rekey timers is the first logical step because it directly addresses the most likely root cause without introducing unnecessary changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the traffic logs for any denial events
Why it's wrong here
Traffic logs record permitted and denied sessions, but an IPSec tunnel that re-establishes periodically points to Phase 2 lifetime or proxy-ID mismatch, which appears in system logs, not traffic logs. Traffic logs are correct when policy is suspected of blocking specific flows.
- ✓
Check the IPSec tunnel status and IKE/IPSEC SA rekey timers
Why this is correct
Intermittent drops that recover after minutes typically indicate IKE or IPSec security association rekeying failures or mismatched lifetimes. Checking tunnel status and rekey timers first confirms whether SAs expire and fail to renegotiate, directly addressing the recurring loss of connectivity described.
- ✗
Reboot the firewall to clear any stale sessions
Why it's wrong here
Rebooting clears state indiscriminately and destroys evidence needed to identify why the tunnel drops; it does not address the rekeying or lifetime mismatch causing the cycle. Rebooting is appropriate only when a firewall is unresponsive and no diagnostics are required.
- ✗
Verify the routing table on both firewalls
Why it's wrong here
Routing tables change only when links or dynamic protocols flap; a tunnel that returns without intervention indicates a negotiation parameter mismatch rather than a missing route. Verifying routing is correct when traffic fails consistently in one direction after a topology change.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.