PCNSE Manage, Monitor and Operate Practice Question
A firewall is experiencing slow performance. The administrator runs 'show counter global' and sees that the 'flow_aged_error_tcp_mss' counter is incrementing rapidly. What does this indicate?
⚠ Common exam trap
Candidates often confuse 'flow_aged_error_tcp_mss' with general TCP session drops or attacks, but the counter specifically points to MSS clamping misconfiguration, not a flood or routing issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP sessions are being terminated due to MSS clamping issues.
The 'flow_aged_error_tcp_mss' counter increments when the firewall ages out TCP sessions due to TCP MSS (Maximum Segment Size) clamping issues. This occurs when the firewall modifies the MSS value in SYN packets to avoid fragmentation, but the actual path MTU is smaller than the clamped MSS, causing the session to be terminated prematurely. The rapid increment indicates that MSS clamping is misconfigured or the path MTU is inconsistent, leading to session failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall is experiencing a SYN flood attack.
Why it's wrong here
SYN floods are indicated by a high 'tcp_syn_flood_counter' or similar, not MSS errors.
- ✓
TCP sessions are being terminated due to MSS clamping issues.
Why this is correct
This counter increments when the firewall actively closes sessions due to MSS mismatch.
- ✗
There is a routing loop causing packet retransmission.
Why it's wrong here
Routing loops are indicated by TTL expired counters, not MSS errors.
- ✗
The firewall's hardware acceleration is failing.
Why it's wrong here
Hardware failures are not indicated by this specific counter.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.