PCNSE Manage, Monitor and Operate Practice Question

A security team uses Panorama to push policy to 40 managed firewalls. An administrator commits a policy change from Panorama, and the commit succeeds on Panorama but fails on 12 firewalls with a validation error. The administrator wants to identify which firewalls failed and the specific error each reported without opening each device individually. Which Panorama feature should the administrator use?

⚠ Common exam trap

The trap here is assuming that a successful commit on Panorama means the policy applied everywhere, when per-device validation can still fail and is only visible in the commit job results.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Task Manager under the Panorama tab, which lists commit job results and per-device error details for the pushed changes.

Panorama pushes configuration to managed devices as commit jobs, and the Task Manager retains the result of each job, including which devices succeeded and which failed along with the error each returned. Reviewing the job detail centrally avoids logging into each firewall. Config Audit, Managed Devices status, and Log Collector aggregation serve different purposes and do not present per-device commit validation failures.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Config Audit under the Panorama tab, which compares the candidate configuration to the running configuration on each device.
Why it's wrong here
Config Audit highlights differences between configuration versions, such as candidate versus running or two committed versions. It is useful for spotting unintended changes, but it does not report commit job failures or the validation errors returned by individual firewalls, so it cannot identify which devices rejected the push.
✗
The Log Collector group configuration, which aggregates commit-related system logs from all managed firewalls into one searchable view.
Why it's wrong here
Log Collector groups aggregate traffic, threat, and system logs forwarded from firewalls. While some commit events may appear as system logs, the aggregated view does not present a consolidated per-device commit job result with the exact validation error for each failed firewall, so it is not the efficient tool for this task.
✗
The Managed Devices summary under the Panorama tab, which shows the connection status and software version of each firewall.
Why it's wrong here
The Managed Devices view shows connectivity, HA state, and software versions. It confirms whether a firewall is reachable and licensed, but it does not capture the result of a specific commit job or the validation error text produced when a pushed policy is rejected, making it unsuitable for this troubleshooting task.
✓
The Task Manager under the Panorama tab, which lists commit job results and per-device error details for the pushed changes.
Why this is correct
Panorama's Task Manager records each commit job, its scope, and the outcome for every managed device. When a pushed commit fails validation on individual firewalls, the job details list the affected devices and the specific error returned by each, allowing centralized troubleshooting without logging into every firewall individually. This is the intended workflow for this scenario.

Go deeper

PCNSE Manage, Monitor and Operate Practice Question

Why each option matters

Option-by-option breakdown

Related to this question