PCNSE Manage, Monitor and Operate Practice Question
An administrator manages a PA-5220 pair running PAN-OS 11.1. During a change window, the active firewall's management plane becomes unreachable and the device fails over to the passive peer. The administrator wants to review the events that occurred on the failed device before the failover. Which action should the administrator take to obtain this information?
⚠ Common exam trap
The trap here is assuming that an unreachable management interface means the logs are lost, when local management plane logs remain accessible through the console.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Connect to the failed device console and review the HA and system logs stored locally in the management plane log files.
Management plane logs are retained locally on each firewall and record system, HA, and configuration events. When the management interface is unreachable but the device still powers on, console access lets the administrator read those logs directly. Panorama config audit, HA state output, and session tables all describe current or configuration state rather than the historical event sequence needed here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Connect to the failed device console and review the HA and system logs stored locally in the management plane log files.
Why this is correct
The management plane stores HA, system, and configuration logs locally on the device. Even when the management interface is unreachable over the network, console access allows the administrator to read these logs and reconstruct the events leading up to the failover, which is the intended way to investigate this scenario.
- ✗
On the passive peer, run the show high-availability state command and export the output to a file for review.
Why it's wrong here
The show high-availability state command displays the current HA state and peer status on the surviving device. It reflects present conditions rather than the historical event sequence that occurred on the failed firewall, and it does not provide the pre-failover log detail the administrator needs.
- ✗
Use the Panorama-managed Config Audit feature to compare the running configuration against the last committed version on the failed device.
Why it's wrong here
Config Audit only compares committed configuration versions and highlights differences between them. It does not capture runtime events such as HA state transitions, link failures, or daemon restarts, so it cannot explain why the management plane became unreachable or why a failover was triggered.
- ✗
On the active peer, run the show session all filter source command to identify sessions that terminated during the failover.
Why it's wrong here
Session tables show live traffic flow information, not control-plane events. Terminated sessions do not record why the management plane failed or why HA transitioned, so this output cannot explain the failover cause. Session data also resets as traffic continues, losing the historical context.
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.