PCNSE Core Concepts and Architecture Practice Question
In an active/passive high-availability pair, the firewall fails over unexpectedly. Investigation shows that the active unit lost connectivity to the upstream router but the link is still up. Which monitoring feature should be configured to prevent false failovers due to temporary router unreachability?
⚠ Common exam trap
Test-takers frequently assume path monitoring is always superior because it checks end-to-end connectivity, but they fail to recognize that it can cause unnecessary failovers during transient network issues, whereas link monitoring is more stable for scenarios where only physical link state matters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use link monitoring instead of path monitoring
Link monitoring only checks the physical link state of an interface, while path monitoring sends ICMP probes to a target IP address to verify end-to-end reachability. In this scenario, the upstream router is unreachable but the link is still up, so link monitoring would not detect the loss of connectivity and would not trigger a failover. Path monitoring, however, would detect the router unreachability and cause an unnecessary failover, which is exactly the problem described. Therefore, using link monitoring instead of path monitoring prevents false failovers caused by temporary router unreachability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Decrease the path monitoring interval
Why it's wrong here
Decreasing the interval would increase sensitivity and cause more failovers, not prevent false ones.
- ✗
HA1 backup link
Why it's wrong here
HA1 backup provides redundancy for the control link, not monitoring.
- ✗
Enable pre-emptive mode
Why it's wrong here
Pre-emptive mode allows the original active unit to resume after recovery, not related to causing failover.
- ✓
Use link monitoring instead of path monitoring
Why this is correct
Link monitoring only detects physical link failures, so temporary router unreachability would not trigger failover.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.