PCNSE Core Concepts and Architecture Practice Question
Exhibit
Refer to the exhibit. admin@PA-5050> show system info | match uptime Uptime: 45 days 3 hours 22 mins admin@PA-5050> show session all filter source 10.1.1.100 destination 192.168.1.50 Session filter returned 0 sessions admin@PA-5050> show counter global | match flow_tcp_non_syn flow_tcp_non_syn: 15 admin@PA-5050> show counter global | match flow_tcp_handshake_fail flow_tcp_handshake_fail: 8
Refer to the exhibit. A firewall administrator is investigating why traffic from a source IP 10.1.1.100 to destination 192.168.1.50 is not establishing sessions. The firewall has been up for 45 days. Based on the counters shown, what is the most likely cause?
⚠ Common exam trap
Many candidates assume a security policy or NAT issue when traffic fails, but the specific counter 'flow_pkt_non_syn_drop' directly points to asymmetric routing, not policy or NAT misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Asymmetric routing causing out-of-state packets
The counters show 'flow_pkt_non_syn' and 'flow_pkt_non_syn_drop' incrementing, which indicates the firewall is receiving packets that do not have the SYN flag set for new session establishment. This is a classic symptom of asymmetric routing, where the firewall sees return or mid-stream packets before the initial SYN, causing it to drop them as out-of-state. Since the firewall has been up for 45 days, stale session table entries are not the issue; the traffic path is likely not symmetric, so the firewall never sees the SYN to create a session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Incorrect NAT rule configuration
Why it's wrong here
NAT issues would not cause TCP non-SYN counters.
- ✗
Security policy denying the traffic
Why it's wrong here
Denied traffic would show in deny counters, not TCP handshake failures.
- ✓
Asymmetric routing causing out-of-state packets
Why this is correct
Non-SYN packets without a session indicate asymmetric routing.
- ✗
Zone Protection Profile dropping SYN packets
Why it's wrong here
Zone protection would block SYN packets, not cause non-SYN packets.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.