PCNSE Practice Question: Managing Troubleshooting and High Availability
A company operates a pair of PA-3220 firewalls in an active/passive HA configuration. The passive firewall is experiencing intermittent HA keepalive failures, causing unnecessary failovers every few minutes. The network engineer checks the HA1 interface statistics and notices packet loss on the dedicated HA1 link. The engineer suspects a physical layer issue. However, the engineer also wants to reduce the sensitivity of the HA keepalive mechanism to tolerate occasional packet loss without triggering a failover. The firewalls are currently using default HA keepalive settings. What should the engineer do to reduce the frequency of false failovers without compromising the ability to detect a true failure?
⚠ Common exam trap
Test-takers frequently think adding a redundant HA2 link (Option C) solves the problem, but it only provides path redundancy and does not change the keepalive timeout sensitivity, so false failovers can still occur if both links suffer packet loss simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.
Increasing the HA keepalive interval and the number of missed keepalives allowed makes the passive firewall less sensitive to transient packet loss on the HA1 link. This reduces false failovers while still ensuring that a sustained loss of heartbeats (indicating a true failure) will eventually trigger a failover. The default HA keepalive settings use a 1-second interval with 3 missed keepalives allowed; increasing these values provides tolerance for intermittent loss without disabling failure detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable HA1 link monitoring and rely solely on path monitoring.
Why it's wrong here
Path monitoring does not replace HA keepalives; it monitors data path, not the heartbeat link.
- ✗
Change the HA mode to active/active to balance traffic and reduce load on the active unit.
Why it's wrong here
Changing HA mode does not solve the keepalive sensitivity issue and may introduce other complexities.
- ✗
Enable HA2 and configure it as a second heartbeat link for redundancy.
Why it's wrong here
Adding HA2 provides link redundancy but does not adjust the keepalive timer sensitivity to packet loss.
- ✓
Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.
Why this is correct
This makes the HA detection less sensitive to sporadic packet loss while still recognizing persistent failure.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.