PCNSE Manage, Monitor and Operate Practice Question
A firewall administrator needs to ensure that traffic matching a specific security policy rule is always logged to Panorama even if the local firewall's management plane is temporarily unreachable. Which configuration should be used?
⚠ Common exam trap
It's easy for candidates to confuse 'Log Forwarding' with simple log redirection, overlooking that 'Buffering' is the specific mechanism that ensures log delivery reliability during management plane outages, rather than relying on HA or external syslog servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a 'Log Forwarding' profile with 'Buffering' enabled.
Enabling 'Buffering' in a Log Forwarding profile causes the firewall to store logs locally when the management plane is unreachable, and then forward them to Panorama once connectivity is restored. This ensures that traffic matching the security policy rule is always logged, even during temporary outages, without requiring additional logging modes or external syslog servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the rule to 'Log at Session End' and use 'Log Forwarding' with 'Enhanced Application Logging'.
Why it's wrong here
This does not buffer logs; if Panorama is unreachable, logs are lost.
- ✓
Configure a 'Log Forwarding' profile with 'Buffering' enabled.
Why this is correct
Buffering queues logs locally and sends them when connectivity with Panorama is restored.
- ✗
Configure 'Log Forwarding' with 'Override' to send logs directly to a syslog server.
Why it's wrong here
Syslog forwarding also requires connectivity; buffering is not a standard feature for syslog.
- ✗
Use the 'High Availability' feature with active/passive.
Why it's wrong here
HA ensures firewall redundancy but does not guarantee log delivery to Panorama.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.