Courseiva
← PCNSE
Full test
Managing Troubleshooting and High Availability →hardMultiple ChoiceObjective-mapped

PCNSE Practice Question: Managing Troubleshooting and High Availability

Exhibit

Refer to the exhibit.

admin@PA-5050> show high-availability state

Group 1 (active/active):
    Local HA state: active-secondary
    Peer HA state: active-primary
    Link monitoring: enabled
    Path monitoring: enabled
    Heartbeat: OK
    Last failover reason: path-group-down

admin@PA-5050> show high-availability link-monitoring

Link Group: uplink
    ethernet1/1: up
    ethernet1/2: down
    ethernet1/3: up
    ethernet1/4: up

admin@PA-5050> show high-availability path-monitoring

Path Group: internet
    10.0.0.1: up
    10.0.0.2: up

Refer to the exhibit. An active/active HA pair shows the local firewall as active-secondary. The last failover reason is 'path-group-down'. What should the administrator investigate first?

⚠ Common exam trap

Many exam-takers confuse 'path-group-down' with HA link failures or session synchronization issues, leading them to investigate HA2 links or session tables instead of the specific interface and path monitoring configuration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Verify the link status of interface ethernet1/2 and its association with the path monitoring group.

The 'path-group-down' failover reason indicates that the firewall detected a failure in a monitored path group, which is associated with specific interfaces. Option B is correct because the administrator should first verify the link status of interface ethernet1/2 and its association with the path monitoring group, as this directly addresses the root cause of the failover trigger. Path monitoring is used to detect upstream connectivity loss and can cause a firewall to transition to active-secondary if the monitored path fails.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Inspect the session table for asymmetric routing between the firewalls.

    Why it's wrong here

    Asymmetric routing is a different issue; the failover reason directly points to path monitoring.

  • ✓

    Verify the link status of interface ethernet1/2 and its association with the path monitoring group.

    Why this is correct

    The link is down, and if it is used for path monitoring, it could cause the path group to go down.

  • ✗

    Ensure the HA2 link is properly connected and firewalls can synchronize sessions.

    Why it's wrong here

    Heartbeat is OK, so HA2 is likely working; the issue is path monitoring.

  • ✗

    Check the HA priority settings to ensure the local firewall should be active-secondary.

    Why it's wrong here

    Priority determines which firewall becomes primary, but the failover reason indicates a path issue, not priority.

About these practice questions

One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.