Courseiva
Manage, Monitor and OperateeasyMultiple ChoiceObjective-mapped

PCNSE Manage, Monitor and Operate Practice Question

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

⚠ Common exam trap

Palo Alto Networks often tests the distinction between the correct field name 'addr.src' versus the incorrect 'src' and the exact event ID 'auth-fail' versus the broader 'auth', exploiting the common misconception that 'src' is a valid shorthand or that 'auth' alone captures failures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

(addr.src eq user@domain.com) and (eventid eq auth-fail)

The filter (addr.src eq user@domain.com) and (eventid eq auth-fail) uses the proper source address field (addr.src) to match the user's IP or identity and the exact event ID for authentication failures (auth-fail). This combination ensures only failed authentication events from that specific user are displayed in the monitor tab, meeting the administrator's requirement precisely.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • (addr.src eq user@domain.com) or (eventid eq auth-fail)

    Why it's wrong here

    OR would show all events for that user or all auth fails, not the intersection.

  • (addr.src eq user@domain.com) and (severity ge medium)

    Why it's wrong here

    Severity does not specifically filter auth failures.

  • (addr.src eq user@domain.com) and (eventid eq auth-fail)

    Why this is correct

    Correctly combines user and auth-fail event.

  • (src eq user@domain.com) and (eventid eq auth)

    Why it's wrong here

    'src' is not the standard field for user; 'eventid eq auth' is too broad.

About these practice questions

One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.