PCNSE Practice Question: Managing Troubleshooting and High Availability
A network engineer is configuring HA on a pair of PA-5220 firewalls. The company requires that the HA1 control link be secured and that the firewalls authenticate each other. Which action should the engineer take?
⚠ Common exam trap
The trap here is assuming that HA1 encryption requires certificates or IPsec, when it is actually enabled by a simple pre-shared key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable HA1 encryption by setting a pre-shared key in the HA configuration.
HA1 control link encryption and authentication are achieved by configuring a pre-shared key. This ensures that only the paired firewalls can exchange HA control messages and that the messages are encrypted. The pre-shared key must match on both peers. This is the standard method to secure HA1 and is a best practice when the HA1 link traverses untrusted networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the management interface for HA1 traffic and enable SSL/TLS encryption on the management plane.
Why it's wrong here
HA1 traffic should not be sent over the management interface because it can cause performance and security issues. HA1 is a dedicated link for control messages. Enabling SSL/TLS on the management plane does not encrypt HA1 traffic. The correct method to secure HA1 is to configure a pre-shared key on the HA1 link itself, not to rely on management plane encryption.
- ✗
Configure the HA1 link to use IPsec by creating a tunnel between the management interfaces.
Why it's wrong here
HA1 control link encryption is not configured via IPsec tunnels; it uses a pre-shared key for encryption and authentication. Creating an IPsec tunnel is unnecessary and would not integrate with the HA subsystem. The firewall handles HA1 encryption natively when a pre-shared key is defined. Using IPsec would add complexity and might not even work for HA1 traffic, which uses a dedicated protocol.
- ✓
Enable HA1 encryption by setting a pre-shared key in the HA configuration.
Why this is correct
Setting a pre-shared key enables encryption of HA1 control traffic and provides mutual authentication between peers. This satisfies both the security and authentication requirements. The pre-shared key is configured under Device > High Availability > General > Control Link. Without it, HA1 messages are sent in clear text and any device could potentially spoof HA messages.
- ✗
Enable HA1 encryption by selecting the 'Encrypt HA1' checkbox and generating a self-signed certificate.
Why it's wrong here
There is no 'Encrypt HA1' checkbox in the HA configuration. HA1 encryption is enabled by specifying a pre-shared key, not by generating a certificate. Certificates are used for other purposes like management or SSL decryption, but not for HA1 link encryption. The firewall uses the pre-shared key to encrypt and authenticate HA1 messages.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.