PCNSE Practice Question: Managing Troubleshooting and High Availability

Exhibit

Refer to the exhibit.
```
admin@PA-5050> show high-availability state

Local:
  mode: active-passive
  state: passive
  link monitoring: enabled
  path monitoring: disabled
  monitor fail-holdup: 0
  HA1 link status: up
  HA2 link status: down

Peer:
  mode: active-passive
  state: active
  link monitoring: enabled
  path monitoring: disabled
  monitor fail-holdup: 0

Group state: complete
```

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

⚠ Common exam trap

Many candidates confuse link monitoring (local interface state) with path monitoring (remote reachability) or assume the HA2 heartbeat link is responsible for failure detection, when in fact HA1 keepalives handle that and link monitoring is the feature that must explicitly include the failed interface.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Link monitoring is enabled but not configured to monitor the specific interface that failed.

Link monitoring on a Palo Alto Networks firewall is configured to monitor specific interfaces. If the upstream link that failed is not included in the link monitoring group, the passive firewall will not detect the loss of that link and will not trigger a failover. The passive firewall only monitors the interfaces explicitly listed under Device > High Availability > Link Monitoring, so an unmonitored interface failure will be ignored for HA purposes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
HA2 heartbeat link is down, preventing the passive from detecting the active's failure.
Why it's wrong here
HA1 is up and sufficient for keepalives; HA2 is redundant.
✗
The fail-holdup timer is set to 0, causing immediate failover but not triggered.
Why it's wrong here
A fail-holdup of 0 means no delay, but the failure must first be detected.
✓
Link monitoring is enabled but not configured to monitor the specific interface that failed.
Why this is correct
Link monitoring must include the interface; otherwise, its state change is ignored for failover decisions.
✗
Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.
Why it's wrong here
Path monitoring is not required for link-based failover; it monitors remote IP reachability.

Go deeper

PCNSE Practice Question: Managing Troubleshooting and High Availability

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question