PCNSE Core Concepts and Architecture Practice Question
An organization runs a pair of Palo Alto Networks firewalls in an active/passive HA configuration. During a maintenance window, the active firewall experiences a link down event on one of its data interfaces. The passive firewall does not assume the active role. What is the most likely reason?
⚠ Common exam trap
Test-takers frequently assume any link failure on a data interface will automatically trigger an HA failover, but Palo Alto Networks firewalls require explicit path monitoring configuration to initiate failover based on data plane link state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Path monitoring is not configured on the interfaces.
In an active/passive HA configuration, a link down event on a data interface does not automatically trigger a failover unless path monitoring is configured. Path monitoring allows the firewall to monitor the link state of specific data interfaces and initiate a failover when those interfaces go down. Without path monitoring, the passive firewall remains passive because it only monitors the HA heartbeat and the active firewall's health via the control link, not the data plane link state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HA is configured in active/active mode, which does not support failover on link failure.
Why it's wrong here
Active/active mode does support path monitoring; both firewalls handle traffic, but a link failure would affect only one.
- ✗
The passive firewall has lost its heartbeat connection to the active firewall.
Why it's wrong here
If heartbeat were lost, both firewalls would consider themselves active or passive separately, but still the passive would not take over without path monitoring.
- ✗
The active firewall has a higher priority value.
Why it's wrong here
Priority determines which firewall becomes active initially, but does not prevent failover when threshold conditions are met.
- ✓
Path monitoring is not configured on the interfaces.
Why this is correct
Correct. Path monitoring monitors the status of data interfaces and triggers failover on link loss.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.