PCNSE Manage, Monitor and Operate Practice Question
A security operations center (SOC) uses Panorama to monitor all firewalls. They notice that some log entries show a severity of 'critical' but the alerting system does not fire. The log forwarding profile on Panorama is configured to send syslog alerts for severity 'critical'. The syslog server receives other logs from Panorama but not these critical logs. The administrator checks the Panorama configuration and finds that the log forwarding profile is applied to the correct log types. What is the most likely issue?
⚠ Common exam trap
Many candidates assume Panorama’s log forwarding profile is the only configuration needed, overlooking that logs must first be collected from the firewall via the Log Collector, and that the firewall’s own logging settings or connectivity can prevent critical logs from reaching Panorama.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The critical logs are generated on the firewall and not forwarded to Panorama.
The most likely issue is that the critical logs are generated on the firewall but not forwarded to Panorama. Panorama can only forward logs it has received from its managed firewalls; if the firewall’s log forwarding or logging settings (e.g., log severity threshold, log buffering, or connectivity to the Log Collector) prevent those critical logs from reaching Panorama, then Panorama’s syslog forwarding profile will never see them. The fact that other logs arrive at the syslog server indicates Panorama’s forwarding works, so the gap must be upstream at the firewall-to-Panorama log collection stage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The log forwarding profile on Panorama is not applied to the managed firewalls.
Why it's wrong here
Panorama forwards its own logs, but firewall logs require the profile pushed to managed firewalls via template or device group; without that, critical entries never reach Panorama's collector for forwarding. It tempts because Panorama-side profiles do govern log collection, yet they only apply to logs Panorama itself generates.
- ✓
The critical logs are generated on the firewall and not forwarded to Panorama.
Why this is correct
Panorama only forwards logs it receives from managed firewalls. If critical logs are generated locally on a firewall and never sent to Panorama, Panorama's log forwarding profile cannot forward them, explaining why the syslog server receives other logs but not these.
- ✗
The Panorama's log collector is not processing the logs correctly.
Why it's wrong here
The syslog server already receives other logs from Panorama, proving the collector processes and forwards correctly; only the critical firewall logs are missing, so the fault lies upstream in profile deployment. Collector troubleshooting tempts when forwarding fails entirely, but partial delivery rules it out.
- ✗
The syslog server is filtering out the critical logs based on the source IP.
Why it's wrong here
Panorama forwards logs to syslog regardless of source IP, and source-based filtering would affect all severities, not only critical entries. It is tempting because firewall or server-side IP filtering is a genuine cause of missing syslog data when a specific device is excluded from the allowed sender list.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.