PCNSE Manage, Monitor and Operate Practice Question
A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between the correct field name 'addr.src' versus the incorrect 'src' and the exact event ID 'auth-fail' versus the broader 'auth', exploiting the common misconception that 'src' is a valid shorthand or that 'auth' alone captures failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
(addr.src eq user@domain.com) and (eventid eq auth-fail)
The filter (addr.src eq user@domain.com) and (eventid eq auth-fail) uses the proper source address field (addr.src) to match the user's IP or identity and the exact event ID for authentication failures (auth-fail). This combination ensures only failed authentication events from that specific user are displayed in the monitor tab, meeting the administrator's requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
(addr.src eq user@domain.com) or (eventid eq auth-fail)
Why it's wrong here
OR would show all events for that user or all auth fails, not the intersection.
- ✗
(addr.src eq user@domain.com) and (severity ge medium)
Why it's wrong here
Severity does not specifically filter auth failures.
- ✓
(addr.src eq user@domain.com) and (eventid eq auth-fail)
Why this is correct
Correctly combines user and auth-fail event.
- ✗
(src eq user@domain.com) and (eventid eq auth)
Why it's wrong here
'src' is not the standard field for user; 'eventid eq auth' is too broad.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.