PCNSE Practice Question: Managing Troubleshooting and High Availability
Exhibit
Refer to the exhibit. 2019-03-15 10:30:15.123 high-availability: HA state change from active to passive (reason: path-monitor-group-down) 2019-03-15 10:30:15.124 high-availability: Path monitoring group 'ISP1' failed: 0 out of 1 destinations reachable
Refer to the exhibit. Based on the log, what triggered the failover?
⚠ Common exam trap
Candidates often confuse path monitoring with simple link monitoring or HA1 heartbeat loss, but the log entry's explicit reference to a 'path monitoring group' is the key differentiator that points to upstream unreachability rather than local interface or HA communication issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A path monitoring group determined that the upstream ISP is unreachable
The log entry indicates that the failover was triggered by a path monitoring group, which detected that the upstream ISP became unreachable. Path monitoring actively probes the next-hop gateway or a target IP address; when the probe fails, the firewall considers the path down and initiates a failover to the passive peer. This is distinct from HA1 heartbeat loss or link failure, as the log explicitly references the path monitoring group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Loss of HA1 heartbeat from the peer
Why it's wrong here
The log shows the failover was triggered by a different event, such as a link or path monitoring failure, not by loss of the HA1 heartbeat. HA1 heartbeat loss is tempting because it is the control-plane link between peers, and its failure would indeed trigger failover in a scenario where the peer becomes unreachable.
- ✗
A link failure on ethernet1/1
Why it's wrong here
The log indicates the failover was caused by a different condition, such as HA1 heartbeat loss or path monitoring, rather than a link failure on ethernet1/1. Link failure monitoring is tempting because it is a common trigger, and would be correct if the log showed the interface going down.
- ✗
An administrator manually triggered a failover
Why it's wrong here
A manual failover appears in logs as an administrative action, not as a monitored-path or link failure event. It is tempting because administrators do trigger failovers, but the exhibit's log entries would show a specific monitored condition such as link down or path monitoring failure instead.
- ✓
A path monitoring group determined that the upstream ISP is unreachable
Why this is correct
Path monitoring groups probe specified destination IPs; when probes fail, the firewall treats the monitored path as down and triggers failover. The log records an unreachable upstream ISP, satisfying the path-monitoring failure condition that initiates the failover.
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.