PCNSE Troubleshoot Practice Question
A Palo Alto Networks firewall experiences high CPU utilization consistently above 90%. Which of the following is the most effective first step to identify the cause?
⚠ Common exam trap
The trap here is that candidates often jump to checking session counts or rule hits, assuming high traffic volume is the cause, but Palo Alto firewalls can experience high CPU from non-traffic sources like logging storms, routing updates, or management plane tasks, which the resource-monitor command directly reveals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the CLI command 'show running resource-monitor' to view CPU usage per module.
The 'show running resource-monitor' CLI command provides a per-module breakdown of CPU utilization, including dataplane, management plane, and individual packet processing threads. This granular view is the most effective first step because high CPU on a Palo Alto firewall is often caused by a specific module (e.g., a dataplane core processing excessive traffic or a session table scan), and isolating the module directs further troubleshooting. Other options, like checking rule hit counts or session counts, are secondary steps that do not pinpoint the CPU-consuming component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the CLI command 'show running resource-monitor' to view CPU usage per module.
Why this is correct
Resource monitor breaks down CPU usage by dataplane and control plane, helping identify the culprit.
- ✗
Review the security policy rule hit counts to see if a specific rule is hit frequently.
Why it's wrong here
Rule hit counts do not correlate directly with CPU utilization.
- ✗
Check the number of active sessions using 'show session info'.
Why it's wrong here
High session count can cause CPU, but it is not a direct indicator; resource monitor gives more detail.
- ✗
Inspect the packet buffer usage with 'show counter packet-buffer'.
Why it's wrong here
Packet buffer usage indicates memory pressure, not necessarily CPU.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.