PCNSE Core Concepts and Architecture Practice Question
A firewall is configured with multiple virtual systems (vsys). The administrator notices that one vsys is consuming excessive dataplane resources, affecting others. Which feature should be used to guarantee each vsys a minimum share of CPU and session capacity?
⚠ Common exam trap
It's easy for candidates to confuse session limits (which cap usage) with resource profiles (which guarantee minimums), leading candidates to choose session limit rules as a way to protect other vsys, when in fact they only prevent a single vsys from exceeding a threshold, not ensuring fair share under contention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Resource profiles
Resource profiles are the correct feature because they allow an administrator to guarantee each virtual system (vsys) a minimum share of dataplane CPU and session capacity. This ensures that resource contention from one vsys does not starve others, providing predictable performance isolation in a multi-tenant firewall environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Packet filtering rules
Why it's wrong here
Packet filtering rules control which traffic is permitted; they do not allocate CPU or session capacity between virtual systems. They tempt because security rules are the usual per-vsys configuration, yet guaranteeing minimum resource shares requires assigning each vsys to a resource profile with guaranteed CPU and session limits.
- ✗
Session limit rules
Why it's wrong here
Session limit rules cap concurrent sessions per vsys but do not allocate CPU or dataplane capacity shares, so a busy vsys still starves others. They suit enforcing per-vsys session ceilings for licence or abuse control, not resource guarantees.
- ✗
QoS profiles
Why it's wrong here
QoS profiles prioritise and shape traffic flows by class, operating on packets rather than allocating CPU or session-table capacity between vsys instances. They fit bandwidth management scenarios, not guaranteeing each vsys a minimum dataplane resource share.
- ✓
Resource profiles
Why this is correct
Resource profiles assign each virtual system guaranteed minimum CPU and session capacity, preventing one vsys from monopolising dataplane resources. This directly satisfies the requirement to guarantee every vsys its minimum share when a single vsys consumes excessive resources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.