PCNSE Manage, Monitor and Operate Practice Question
Exhibit
Refer to the exhibit. admin@PA-3020> show session info Total active sessions: 45000 TCP sessions: 40000 UDP sessions: 5000 admin@PA-3020> show session stats Max sessions: 100000 Current sessions: 45000 admin@PA-3020> show running resource-monitor Dataplane CPU: 85%
Refer to the exhibit. The firewall is experiencing high dataplane CPU usage (85%) with 45,000 active sessions out of a maximum of 100,000. Which of the following is the most likely cause of the high CPU?
⚠ Common exam trap
Test-takers frequently assume high CPU must be due to reaching session limits or an attack, but the Palo Alto Networks PCNSE exam tests the understanding that SSL decryption's per-session cryptographic overhead can cause high CPU even at moderate session counts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL decryption is enabled and processing many sessions
SSL decryption is a highly CPU-intensive operation because it requires the firewall to terminate and re-encrypt TLS connections, performing asymmetric and symmetric cryptographic operations for each session. With 45,000 active sessions, even if the session count is below the 100,000 limit, the per-session processing overhead of SSL decryption can drive dataplane CPU to 85%.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSL decryption is enabled and processing many sessions
Why this is correct
SSL decryption is CPU-intensive.
- ✗
The firewall is reaching its maximum session limit
Why it's wrong here
Session count is only 45% of max.
- ✗
The firewall is under a DDoS attack
Why it's wrong here
DDoS would likely cause session count to be much higher.
- ✗
There is a high rate of UDP sessions
Why it's wrong here
UDP sessions are low (5000).
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.