PCNSE Split Brain Practice Question
A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?
⚠ Common exam trap
The trap is that candidates may think both firewalls being active indicates Active/Active mode, but in an active/passive pair, this is a split-brain failure condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Split brain
In a Palo Alto Networks active/passive HA configuration, if the heartbeat fails, both firewalls assume the other is down and both transition to 'active' state. This unintended condition is called split brain. It is not a valid configuration like Active/Active, which is intentionally configured and requires separate virtual routers or security zones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Link failure
Why it's wrong here
Link failure is a physical or logical interface fault that can trigger failover, but it does not describe the resulting state where both firewalls report active. It is tempting because link monitoring is central to HA operation, and it would be correct if the question asked what caused a failover event rather than naming the split state.
- ✗
Active/Active
Why it's wrong here
Active/Active describes an intentional configuration where both peers process traffic simultaneously, not a fault where both claim active state in a pair designed for failover. It is tempting because the name matches the symptom literally, and it would be correct when describing a deliberately load-sharing HA deployment.
- ✗
Passive/Passive
Why it's wrong here
Passive/Passive is a valid HA mode where neither device actively forwards until failover, so it cannot describe two firewalls simultaneously showing active. It is tempting because it is a recognised HA configuration, and it would be correct when describing a deployment where both peers remain standby.
- ✓
Split brain
Why this is correct
Both peers believing they are active defines split brain, caused by loss of the HA heartbeat link while dataplane traffic still flows. Each firewall independently assumes the active role, producing duplicate sessions and conflicting state. The stem's symptom of two simultaneous 'active' states is precisely this condition.
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.