PCNSE Manage, Monitor and Operate Practice Question
An administrator wants to be notified whenever any administrator account is locked out after repeated failed login attempts. The notification must be sent by email to the security team. Which configuration accomplishes this?
⚠ Common exam trap
Many exam-takers confuse Log Forwarding profiles, which apply to Security policy session logs, with the management-plane log settings that control event-driven email alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an Email server profile and enable email notifications for the authentication log under Device > Log Settings.
Email notification for management-plane events is configured under Device > Log Settings, where an Email server profile is selected and specific log types such as the authentication log are flagged for email alerts. This delivers an immediate message to the security team when an administrator account is locked out, meeting the notification requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an Email server profile and a Log Forwarding profile that matches auth log entries, then apply it to the management interface.
Why it's wrong here
Log Forwarding profiles are attached to Security and other policy rules and forward session logs; they cannot be applied to the management interface for authentication events. While an Email server profile is needed for email delivery, this combination does not capture administrator lockout events, so the security team would not receive the required notification.
- ✓
Configure an Email server profile and enable email notifications for the authentication log under Device > Log Settings.
Why this is correct
The management-plane log settings under Device > Log Settings allow an administrator to specify an Email server profile and choose which system or authentication events generate email alerts. Enabling email notification for authentication log events causes a message to be sent when an administrator account is locked out, which is exactly the required behavior.
- ✗
Create a custom report that filters authentication log entries and schedule it to be emailed every five minutes.
Why it's wrong here
A scheduled custom report provides periodic summaries rather than immediate event-driven notification, so a lockout might not be reported until the next interval. It also relies on dataplane log data and report generation, which is a heavier and less direct mechanism than log-based email alerting for a specific authentication event.
- ✗
Enable SNMP traps on the management interface and configure the SNMP manager to interpret authentication failure traps.
Why it's wrong here
SNMP traps can signal certain system events, but administrator lockout from failed logins is not delivered as a standard SNMP trap in a way that carries the needed detail, and the requirement explicitly asks for email notification. Using SNMP would not satisfy the stated delivery method or reliably identify the lockout event.
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.