PCNSE Deploy and Configure Firewalls Practice Question
An organization has a firewall in HA active-passive mode. After a failover, the new active firewall does not have the latest session table. What should be configured to ensure session synchronization?
⚠ Common exam trap
Watch out — candidates often confuse configuration synchronization (commit force sync) with runtime state synchronization (session sync), leading them to select Option D, but commit force sync only pushes configuration changes, not dynamic session data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HA session sync
HA session synchronization (session sync) is the feature that replicates active session state from the active firewall to the passive firewall in an active-passive HA pair. Without this configuration, after a failover the new active firewall has no knowledge of existing sessions, causing all active connections to be dropped and requiring clients to re-establish them. Enabling session sync ensures the passive firewall maintains a synchronized session table, allowing seamless traffic continuation after failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Packet capture on active
Why it's wrong here
Packet capture is a diagnostic tool that records traffic for analysis; it neither transfers nor synchronises session state between peers. It is tempting when troubleshooting failover drops, but the requirement is HA session synchronisation, which packet capture cannot provide.
- ✗
Session setup on both peers
Why it's wrong here
Session setup governs how the firewall handles session establishment for its own traffic, not state replication to the peer. It is tempting because it sounds session-related, yet synchronisation requires HA session state sharing, which this setting does not enable.
- ✓
HA session sync
Why this is correct
HA session sync replicates the session table from the active firewall to the passive peer, so after failover the newly active device already holds established sessions. Without it, traffic matching existing sessions is dropped, breaking continuity for stateful flows.
- ✗
Commit force sync
Why it's wrong here
Commit force sync pushes the running configuration to the passive peer; it does not synchronise the session table, so sessions still drop after failover. It is tempting because it is the standard remedy when HA peers' configurations diverge, which is a configuration-drift problem rather than a session-state problem.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.