PCNSE Manage, Monitor and Operate Practice Question
A financial institution operates a pair of PA-5260 firewalls in active/active HA using Virtual Wire mode. They are experiencing intermittent asymmetric traffic flows causing session setup failures. The firewall logs show sessions being created with a one-sided flow. Which configuration change is most likely to resolve this issue?
⚠ Common exam trap
Many exam-takers confuse 'session offloading' with 'session distribution' and assume disabling offloading will fix asymmetric flows, when in fact it breaks session sharing and makes the problem worse.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure session distribution to use IP hash instead of round-robin.
In an active/active HA pair using Virtual Wire mode, asymmetric traffic flows can cause session setup failures because each firewall may see only one direction of the traffic. Configuring session distribution to use IP hash (e.g., based on source and destination IP addresses) ensures that all packets belonging to the same flow are consistently forwarded to the same firewall, preventing one-sided sessions. This resolves the issue by guaranteeing session affinity across the HA pair.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable symmetric return on the virtual wire interfaces.
Why it's wrong here
Symmetric return is not a configurable option in Virtual Wire mode.
- ✗
Disable session offloading between the HA peers.
Why it's wrong here
Disabling offloading would limit session sharing and likely worsen the problem.
- ✗
Set the HA timer to asymmetric routing active/passive mode.
Why it's wrong here
No such HA timer option exists; active/active mode is designed to handle asymmetric routing differently.
- ✓
Configure session distribution to use IP hash instead of round-robin.
Why this is correct
IP hash ensures all packets of a session go to the same firewall, preventing asymmetric flow issues.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.