PCNSE Practice Question: Managing Troubleshooting and High Availability
During a failover test, an engineer observes that after the active firewall fails, the passive firewall takes over, but existing UDP sessions are not maintained. What is the most likely reason?
⚠ Common exam trap
Candidates often assume all sessions are synchronized by default in active/passive HA, but the PCNSE exam specifically tests the nuance that UDP sessions are not synchronized unless explicitly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UDP sessions are not synchronized by default in active/passive mode
In an active/passive HA pair, session synchronization is enabled by default for TCP sessions but not for UDP sessions. UDP is considered connectionless, and the firewall does not maintain state information for UDP flows in the same way as TCP. Therefore, when a failover occurs, existing UDP sessions are not preserved because their state was never synchronized to the passive firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The HA pair is in active/active mode
Why it's wrong here
Active/active syncs all sessions.
- ✗
The failover delay timer is too long
Why it's wrong here
Failover delay affects timing, not session preservation.
- ✓
UDP sessions are not synchronized by default in active/passive mode
Why this is correct
Only TCP sessions are synced by default; UDP sessions require additional configuration.
- ✗
Session synchronization is disabled on the passive firewall
Why it's wrong here
Session sync is generally enabled on both.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.