How should I use these Manage, Monitor and Operate practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Manage, Monitor and Operate questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Manage, Monitor and Operate domain.

PCNSE · topic practice

Manage, Monitor and Operate practice questions

The Manage, Monitor and Operate domain covers day-to-day firewall administration on PAN-OS: generating tech support files, configuring log forwarding, diagnosing resource problems, and making configuration changes like adding zones. Questions are scenario-based, asking you to pick the correct CLI command, required configuration steps, or ordered workflow rather than recite definitions.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Manage, Monitor and Operate

Practice 10 questions Browse domain →

What the exam tests

What to know about Manage, Monitor and Operate

You must be able to run the correct operational CLI commands, build and apply log forwarding profiles, and diagnose resource issues by cause. The single most important thing: know which command or configuration step actually produces the required outcome, not just its name.

Using the debug command to generate a tech support file for TAC analysis

Configuring log forwarding profiles and applying them to Security policy rules

Identifying causes of high CPU utilization such as logging, decryption, and threat inspection

Ordering zone configuration steps: create zone, assign interfaces, commit

Watch out for

Common Manage, Monitor and Operate exam traps

▸Assuming log forwarding works after only creating a syslog server profile, forgetting to attach the profile to the Security policy rule
▸Confusing the tech support file command with packet capture or session dump commands that do not bundle full diagnostics
▸Blaming high CPU on hardware when management-plane tasks, logging, or content inspection are the actual drivers

Practice set

Manage, Monitor and Operate questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Manage, Monitor and Operate explanation →

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

Trap 1: (addr.src eq user@domain.com) or (eventid eq auth-fail)

The or operator returns every event matching either condition, so all traffic from that address appears alongside failed authentications from any user. It is tempting because both terms are relevant, but and is required to intersect the user with the auth-fail eventid and isolate the failures.

Trap 2: (addr.src eq user@domain.com) and (severity ge medium)

Severity medium does not correspond to authentication failure; it captures unrelated medium-and-above events for that address, missing auth failures logged at lower severity. Filtering by severity is tempting for triage, but the eventid auth-fail field identifies the specific event type required here.

Trap 3: (src eq user@domain.com) and (eventid eq auth)

The src field does not hold the user identity in this log schema, and eventid eq auth matches successful authentications rather than failures. Using src and a generic auth eventid is tempting because both look user- and auth-related, but the correct fields are addr.src and eventid auth-fail.

Study all Manage, Monitor and Operate common traps →

A
(addr.src eq user@domain.com) or (eventid eq auth-fail)
Why it fails: The or operator returns every event matching either condition, so all traffic from that address appears alongside failed authentications from any user. It is tempting because both terms are relevant, but and is required to intersect the user with the auth-fail eventid and isolate the failures.
B
(addr.src eq user@domain.com) and (severity ge medium)
Why it fails: Severity medium does not correspond to authentication failure; it captures unrelated medium-and-above events for that address, missing auth failures logged at lower severity. Filtering by severity is tempting for triage, but the eventid auth-fail field identifies the specific event type required here.
C
(addr.src eq user@domain.com) and (eventid eq auth-fail)
Correctly combines user and auth-fail event.
D
(src eq user@domain.com) and (eventid eq auth)
Why it fails: The src field does not hold the user identity in this log schema, and eventid eq auth matches successful authentications rather than failures. Using src and a generic auth eventid is tempting because both look user- and auth-related, but the correct fields are addr.src and eventid auth-fail.

Manage, Monitor and Operate practice questions

What to know about Manage, Monitor and Operate

Common Manage, Monitor and Operate exam traps

Manage, Monitor and Operate questions

A security administrator notices that a specific user is generating excessive logs due to repeated authentication failures. The administrator wants to see only failed authentication events for that user in the monitor tab. Which filter string should be used in the log viewer?

A firewall is configured with two ISPs for redundancy. The administrator wants to ensure that traffic from internal users is load-balanced across both links based on source IP. Which configuration method should be used?

A firewall is deployed in an Active/Passive HA pair. The administrator notices that the passive firewall is not synchronizing configuration changes. The 'show high-availability state' command shows the passive firewall in a 'non-functional' state. What is the most likely cause?

Which TWO of the following are valid methods to upgrade the PAN-OS software on a firewall? (Choose two.)

Which THREE of the following are valid actions that can be taken on a dynamic block list entry? (Choose three.)

Refer to the exhibit. The firewall is experiencing high dataplane CPU usage (85%) with 45,000 active sessions out of a maximum of 100,000. Which of the following is the most likely cause of the high CPU?

Exhibit

Refer to the exhibit. The firewall is active in an HA pair, but the peer is non-functional. The HA2 link is down. What is the most likely cause of the peer being non-functional?

Exhibit

Match each Palo Alto Networks feature to its primary function.

Match each Palo Alto Networks product to its primary use case.

A network administrator notices that traffic logs are not being sent to the external Syslog server. The log forwarding profile is configured correctly. Which CLI command should be used to verify the Syslog server connectivity from the firewall?

During a Panorama upgrade from version 9.0 to 9.1, the administrator notices that the commit fails on one of the managed firewalls with the error: 'Mismatched content version'. What is the most likely cause?

An administrator needs to generate a tech support file for TAC. Which CLI command accomplishes this?

A firewall is experiencing slow performance. The administrator runs 'show counter global' and sees that the 'flow_aged_error_tcp_mss' counter is incrementing rapidly. What does this indicate?

Which TWO methods can be used to monitor traffic passing through a Palo Alto Networks firewall?

Which THREE steps should be performed when upgrading an active/passive HA pair to a new PAN-OS version?

A network engineer needs to configure SNMP traps on a PA-5250 running PAN-OS 10.2 to alert when CPU usage exceeds 80% for more than 10 minutes. Which CLI command should be used to set this threshold?

An administrator wants to see only the candidate configuration changes that have not yet been committed. Which CLI command should be used?

An engineer notices a decrease in network performance and wants to verify if a specific security policy is being triggered frequently. Which CLI command will show the hit count for a specific policy?

Track your progress over time

Start a Manage, Monitor and Operate only practice session

Related PCNSE topic practice pages

Manage, Monitor and Operate practice questions

Deploy and Configure Firewalls practice questions

Securing Traffic and App-ID practice questions

Decryption and SSL Inspection practice questions

Securing Users and Applications with Authentication practice questions

Managing Troubleshooting and High Availability practice questions

Core Concepts and Architecture practice questions

Secure Access and VPN practice questions

Troubleshoot practice questions

PCNSE fundamentals practice questions

PCNSE scenario practice questions

PCNSE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid