Courseiva

CCNA Managing Troubleshooting Ha Questions

47 questions · Managing Troubleshooting Ha topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

An administrator runs 'show high-availability state' and sees that the local firewall is in 'passive' state, but the remote firewall shows 'active'. However, the HA1 link is up and the configuration is synchronized. What could cause the passive firewall to not take over after the active fails?

A.The configuration is not synchronized
B.Session synchronization is not fully complete
C.The HA2 link is down
D.Preemptive mode is disabled and the passive firewall has a lower priority
AnswerC

HA2 link is for session sync, not state.

Why this answer

If the HA2 link is down, the passive firewall cannot synchronize session state from the active firewall. In Palo Alto Networks HA implementations, the passive firewall requires a functional HA2 link to be considered fully operational and ready to take over; without it, the passive will not assume the active role even if the active fails. The HA1 link ensures heartbeats and configuration synchronization, but state synchronization over HA2 is critical for failover eligibility.

Exam trap

Candidates often assume that a functional HA1 link and synchronized configuration guarantee automatic failover, but they overlook the dependency on the HA2 link for state synchronization and failover readiness.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the configuration is synchronized, so this is not the cause. Option B is wrong because session synchronization is unrelated to the failover trigger; session sync ensures stateful failover but does not affect the passive firewall's ability to become active after a failure. Option C is wrong because the HA2 link (data link) is not required for failover detection; the HA1 link (control link) is used for keepalive messages and is reported as up, so the passive firewall should detect the active failure via HA1.

Practice this question →
2
Multi-Selectmedium

A network engineer is configuring an active/passive HA pair of Palo Alto Networks firewalls. The engineer wants to ensure that a specific interface failure triggers a failover, but only if the interface loses connectivity to its directly connected next-hop router. Which two configuration settings must be enabled to achieve this behavior?

Select 2 answers
A.Configure HA2 as a backup heartbeat link.
B.Enable link monitoring on the interface.
C.Set HA1 link monitoring to ping the peer firewall's management IP.
D.Enable path monitoring on the interface with a monitoring destination IP of the next-hop router.
E.Set the passive link state to 'auto'.
AnswersB, D

Link monitoring detects physical link state changes; combined with path monitoring, it triggers failover only when both conditions are met.

Why this answer

Link monitoring detects a physical link failure on the interface and triggers a failover. Option D is correct because path monitoring goes beyond link state by sending ICMP pings to a specific next-hop IP address, ensuring that even if the link is up but the next-hop router is unreachable, a failover occurs. Together, these settings provide the desired behavior: failover only when the interface loses connectivity to its directly connected next-hop router.

Exam trap

The trap here is confusing link monitoring (physical layer) with path monitoring (network layer); candidates often assume link monitoring alone is sufficient, but it does not detect scenarios where the link is up but the next-hop router is unreachable.

Practice this question →
3
MCQeasy

A network engineer needs to troubleshoot why a specific user cannot access a web application through a Palo Alto Networks firewall. The engineer has verified that the user's traffic reaches the firewall and that no security policy explicitly blocks the traffic. Which CLI command should be used to check if the traffic is being matched by a hidden or implicit rule?

A.show session all
B.debug dataplane packet-diag
C.test security-policy-match source <ip> destination <ip> destination-port <port> protocol <tcp>
D.show running security-policy
AnswerC

This command tests traffic against the security policy and shows the matching rule, including implicit denies.

Why this answer

'test security-policy-match', is the correct command because it simulates a packet against the firewall's security policy rulebase, including any hidden or implicit rules (such as the default intra-zone allow or inter-zone deny rules). This allows the engineer to see exactly which rule the traffic matches, even if no explicit policy is configured, which is essential for troubleshooting implicit rule behavior.

Exam trap

The trap here is that candidates often assume 'show running security-policy' or 'show session all' can reveal implicit rule matches, but they only show explicit configurations or active sessions, respectively, missing the hidden default rules that are evaluated by the firewall's policy engine.

How to eliminate wrong answers

Option A is wrong because 'show session all' displays active sessions, not the policy matching decision for a specific traffic flow; it cannot reveal whether traffic is blocked by an implicit rule before a session is created. Option B is wrong because 'debug dataplane packet-diag' is used for deep packet-level debugging of dataplane forwarding, not for checking security policy matches against the rulebase. Option D is wrong because 'show running security-policy' only displays explicitly configured security rules; it does not show hidden or implicit rules (e.g., the default intra-zone allow or inter-zone deny), so it cannot confirm if traffic is being matched by such rules.

Practice this question →
4
MCQmedium

After a failover event, some user sessions are reset. The HA pair is configured for Active/Active with session distribution using a hash algorithm. What is the most likely reason for session resets?

A.Session offload is not enabled on the passive firewall
B.Packet Buffer Protection threshold was exceeded
C.Session synchronization is not configured between the HA peers
D.The routing table is not redistributed after failover
AnswerC

Without session sync, active firewall's sessions are unknown to the other.

Why this answer

In an Active/Active HA pair with session distribution based on a hash algorithm, each firewall handles a subset of traffic flows. Without session synchronization between the peers, the backup firewall has no session table entries for flows hashed to the primary. After a failover, the backup firewall sees these packets as new connections and resets them because it lacks the state information required to continue the existing sessions.

Exam trap

The trap here is that candidates confuse session synchronization with routing redistribution or assume that Active/Active inherently shares session state, when in fact session synchronization must be explicitly configured and is not automatic even in Active/Active mode.

How to eliminate wrong answers

Option A is wrong because session offload is a feature for offloading session setup to a secondary processor, not related to HA session synchronization; the passive firewall in Active/Active is not a concept—both are active. Option B is wrong because Packet Buffer Protection is a DoS protection mechanism that drops packets when buffer thresholds are exceeded, not a cause of session resets specifically after a failover event. Option D is wrong because routing table redistribution is handled by the HA control link and dynamic routing protocols (e.g., OSPF, BGP) independently of session state; routing convergence does not cause session resets—missing session state does.

Practice this question →
5
Multi-Selectmedium

An organization has configured an active/passive high availability pair of Palo Alto Networks firewalls. During a maintenance window, the active firewall was rebooted. After the reboot, the passive firewall became active, but the session table on the original active firewall is incomplete. The administrator notices that session synchronization is not working properly. Which two configuration checks should the technician perform to resolve this issue?

Select 2 answers
A.Check that the session synchronization encryption is disabled to reduce latency.
B.Validate that the heartbeat hold timer is set to a value greater than the failover delay.
C.Confirm that the HA1 link is using the correct IP address and is in the same subnet.
D.Verify that the HA2 link is operational and has sufficient bandwidth.
E.Ensure that the HA firewalls have the same software version and that session synchronization is enabled in the HA configuration.
AnswersD, E

The HA2 link is dedicated to session synchronization; if it is down or congested, sync fails.

Why this answer

Session synchronization in an active/passive HA pair uses the HA2 link (or HA2 backup) to replicate session tables between firewalls. If the HA2 link is down, has insufficient bandwidth, or is misconfigured, session synchronization will fail, causing the newly active firewall to have an incomplete session table after a failover. Verifying that the HA2 link is operational and has sufficient bandwidth is therefore a critical first step in troubleshooting this issue.

Exam trap

The trap here is that candidates often confuse the HA1 and HA2 link roles, assuming that checking the HA1 link (used for heartbeats and configuration sync) will resolve session synchronization issues, when in fact session replication relies exclusively on the HA2 link.

Practice this question →
6
Multi-Selecteasy

Which TWO statements about active/active HA mode are true compared to active/passive mode? (Choose two.)

Select 2 answers
A.Active/active eliminates the need for failover
B.Active/active requires enabling asymmetric routing support
C.Active/active allows both firewalls to process traffic simultaneously
D.Active/active automatically synchronizes configuration changes
E.Active/active is the default and most commonly deployed mode
AnswersB, C

Needed to handle return traffic on different firewall.

Why this answer

In active/active HA mode, both firewalls can process traffic simultaneously, which requires enabling asymmetric routing support to handle traffic that may arrive at either firewall for the same session. This is necessary because active/active mode does not enforce a single path for traffic, unlike active/passive mode where only one firewall actively processes traffic.

Exam trap

The trap here is that candidates often assume active/active mode eliminates the need for failover or is the default mode, but in reality, failover is still required and active/passive is the default; the key differentiator is the need for asymmetric routing support in active/active mode.

Practice this question →
7
Multi-Selecthard

Which TWO conditions can cause an HA pair to enter an 'active/active' state? (Choose two.)

Select 2 answers
A.Loss of HA keepalive on both sides
B.License expiration on one firewall
C.Session synchronization failure
D.Configuration mismatch between peers
E.HA1 link failure
AnswersA, E

If keepalives are lost, each firewall assumes the other is dead and becomes active.

Why this answer

A is correct because when both firewalls lose the HA keepalive (sent over HA1 link), each firewall assumes the peer is dead and transitions to active state to ensure traffic continuity. This is a fail-safe mechanism: without keepalive, each unit independently becomes active, resulting in an active/active condition that can cause duplicate IP addresses and traffic loops.

Exam trap

The trap here is that candidates often think only a complete HA1 link failure (option E) causes active/active, but they overlook that loss of keepalive on both sides (option A) is the underlying mechanism—and both conditions are correct because HA1 link failure directly causes loss of keepalive on both sides.

Practice this question →
8
MCQhard

A medium-sized enterprise has two Palo Alto Networks PA-5250 firewalls configured in an active/passive HA pair with session synchronization and configuration synchronization enabled. The HA1 link is a direct copper cable, and the HA2 link is also a direct copper cable. The firewalls are connected to two upstream routers (R1 and R2) and two downstream switches (S1 and S2). The network uses OSPF for dynamic routing. The active firewall (FW-A) is connected to R1 and S1, while the passive firewall (FW-P) is connected to R2 and S2. The OSPF cost is set symmetrically on both sides. During a maintenance window, the network team shuts down the HA1 and HA2 links on both firewalls to test failover behavior. After the links are brought back up, the firewalls are in a state of 'non-functional' and 'suspended'. The team suspects the HA configuration is broken. What is the most likely cause and the best course of action to restore HA?

A.Upgrade both firewalls to the same software version and then re-initialize HA
B.Change the HA mode to active/active and enable asymmetric routing
C.Reboot both firewalls after verifying the HA configuration and that the links are operationally up
D.Configure a dedicated management interface for HA1 communication and ensure HA2 is on a different subnet
AnswerC

Rebooting recovers from suspended state; links are up now.

Why this answer

When both HA1 and HA2 links are simultaneously shut down on both firewalls, the active/passive pair loses all communication and session synchronization. Upon restoration, the firewalls enter a 'non-functional' and 'suspended' state because the HA control plane cannot re-establish a quorum or verify the peer's state without a full reset of the HA state machine. Rebooting both firewalls after verifying the HA configuration and that the links are operationally up forces a clean initialization of the HA process, clearing the suspended state and allowing the pair to renegotiate roles correctly.

Exam trap

The trap here is that candidates assume re-establishing the HA links alone will automatically restore the HA pair, but PAN-OS requires a full reboot of both firewalls to clear the suspended state after a simultaneous HA link failure, as the state machine does not have a built-in recovery mechanism for this scenario.

How to eliminate wrong answers

Option A is wrong because upgrading software versions is irrelevant to the immediate issue; the firewalls were already running the same version before the test, and the problem is a state machine lockup, not a version mismatch. Option B is wrong because changing to active/active mode does not resolve a suspended state caused by HA link disruption; it would require a different configuration and does not address the core issue of HA state recovery. Option D is wrong because dedicating a management interface for HA1 or changing subnets does not fix the current suspended state; HA1 and HA2 were already on direct copper cables, and the problem is not about subnet overlap but about the HA process needing a full restart after simultaneous link loss.

Practice this question →
9
MCQhard

During a network incident, an engineer notices that after an HA failover, some sessions are not active on the new active firewall. The 'show session all' command shows the sessions with state 'half-closed'. What is the most likely cause?

A.The firewall failed to properly synchronize the TCP sessions before the failover
B.The HA2 link failover timer is set too low
C.The ARP timeout on the next-hop router is too short
D.Asymmetric routing is causing the firewall to see only one direction of traffic
AnswerA

Incomplete sync leads to half-closed sessions.

Why this answer

The 'half-closed' session state indicates that the firewall has only one side of the TCP handshake (FIN or RST) recorded, which typically occurs when session synchronization fails during an HA failover. In an active/passive HA pair, TCP session state information is synchronized via the HA2 link; if synchronization is incomplete or interrupted before the failover, the new active firewall will have partial session data, leading to half-closed sessions. This is a common symptom of a synchronization failure, not a timeout or routing issue.

Exam trap

The trap here is that candidates confuse 'half-closed' with 'incomplete' or 'asymmetric routing' symptoms, but 'half-closed' specifically indicates a TCP state where one side has initiated closure, which in an HA context points to incomplete session synchronization rather than a routing or ARP issue.

How to eliminate wrong answers

Option B is wrong because the HA2 link failover timer controls how quickly the passive firewall detects a failure of the active firewall, not the synchronization of session states; a low timer might cause premature failover but does not directly cause half-closed sessions. Option C is wrong because the ARP timeout on the next-hop router affects layer 2 reachability and could cause traffic black-holing after failover, but it does not impact the TCP session state stored on the firewall; half-closed sessions are a session table issue, not an ARP issue. Option D is wrong because asymmetric routing would cause the firewall to see only one direction of traffic, leading to sessions in a 'half-baked' or 'incomplete' state (not 'half-closed'), and it is not directly related to HA failover synchronization; asymmetric routing is a network design problem, not a post-failover session state issue.

Practice this question →
10
MCQeasy

A network engineer is troubleshooting an HA pair where both firewalls show as 'active' in the HA state. What is this condition called?

A.Link failure
B.Active/Active
C.Passive/Passive
D.Split brain
AnswerD

Correct. When both firewalls in an active/passive pair show active due to loss of heartbeat, this is called split brain.

Why this answer

In a Palo Alto Networks active/passive HA configuration, if the heartbeat fails, both firewalls assume the other is down and both transition to 'active' state. This unintended condition is called split brain. It is not a valid configuration like Active/Active, which is intentionally configured and requires separate virtual routers or security zones.

Exam trap

The trap is that candidates may think both firewalls being active indicates Active/Active mode, but in an active/passive pair, this is a split-brain failure condition.

How to eliminate wrong answers

Option A is wrong because a link failure is a potential cause of split brain, not the condition itself. Option C is wrong because passive/passive is not a valid HA state in Palo Alto Networks firewalls; the supported modes are active/passive and active/active (for specific use cases). Option D is wrong because split brain is the correct term for both firewalls being active simultaneously, not a separate option.

Practice this question →
11
MCQmedium

An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

A.Increase the HA keepalive failover threshold to tolerate temporary packet loss
B.Decrease the HA1 hello interval
C.Enable link monitoring on all interfaces
D.Increase the session synchronization rate
AnswerA

Higher threshold allows brief outage without triggering failover.

Why this answer

Increasing the HA keepalive failover threshold allows the firewalls to tolerate a brief network outage without triggering a split-brain scenario. By requiring more missed heartbeats before declaring the peer dead, the firewalls avoid both becoming active simultaneously due to transient packet loss. This directly addresses the root cause—premature failover during temporary connectivity issues.

Exam trap

The trap here is that candidates often confuse increasing the failover threshold with making HA less reliable, when in fact it adds tolerance to temporary network blips, preventing the split-brain condition that occurs when both firewalls assume the other is dead.

How to eliminate wrong answers

Option B is wrong because decreasing the HA1 hello interval would make the firewalls send heartbeats more frequently, increasing sensitivity to packet loss and making split-brain more likely, not less. Option C is wrong because enabling link monitoring on all interfaces monitors physical link status, not HA keepalive failures; it would not prevent split-brain caused by a brief network outage that does not bring down interfaces. Option D is wrong because increasing the session synchronization rate affects how quickly session tables are synced between peers, not the detection of peer failure or split-brain prevention.

Practice this question →
12
MCQeasy

Refer to the exhibit. What is the primary cause of the 'non-functional' state?

A.The configuration sync operation has failed
B.One firewall is not running
C.HA1 link failure between 10.1.1.1 and 10.1.1.2
D.The configuration on the two firewalls is not identical
AnswerD

Configuration mismatch directly causes non-functional state.

Why this answer

The 'non-functional' state in a Palo Alto Networks HA pair indicates that the configuration synchronization (config sync) has failed because the configurations on the two firewalls are not identical. This is a prerequisite for HA operation; if the configurations differ, the HA pair cannot establish a functional sync state, even if HA1 and HA2 links are up.

Exam trap

The trap here is that candidates often confuse 'non-functional' with a link failure or peer down state, but the 'non-functional' state is uniquely tied to configuration synchronization issues, not connectivity or hardware failures.

How to eliminate wrong answers

Option A is wrong because a configuration sync operation failure is a symptom, not the primary cause; the root cause is the configuration mismatch itself. Option B is wrong because if one firewall were not running, the HA state would show 'down' or 'disconnected', not 'non-functional'. Option C is wrong because an HA1 link failure would result in a 'suspended' or 'down' state for the HA link, not a 'non-functional' state for the HA pair; the HA pair can still be functional with a single HA link if HA2 is available.

Practice this question →
13
MCQmedium

An engineer notices that after an HA failover, the new active firewall is not passing traffic. The show running ip route command shows the default route is missing. What is the most likely cause?

A.Floating static routes were not configured on the passive firewall.
B.Static routes were not synchronized.
C.OSPF routes were not synchronized.
D.BGP routes were not synchronized.
AnswerA

Floating static routes are not synchronized and must be configured on both firewalls.

Why this answer

In an active/passive HA pair, static routes are not automatically synchronized from the active to the passive firewall. The passive firewall must have its own static routes configured, often as floating static routes with a higher administrative distance to avoid conflicts during normal operation. When a failover occurs, the new active firewall (formerly passive) lacks the default route because it was never configured or synchronized, causing traffic to fail.

Exam trap

The trap here is that candidates assume all routes are synchronized in HA, but PAN-OS only synchronizes dynamic routing protocol states and not static route configuration, requiring explicit configuration on both peers.

How to eliminate wrong answers

Option B is wrong because static routes are not synchronized by default in PAN-OS HA; they must be configured independently on each peer. Option C is wrong because OSPF routes are dynamically learned and would be re-established after failover via neighbor adjacencies, not missing due to synchronization issues. Option D is wrong because BGP routes are also dynamically learned and would be re-established via BGP sessions after failover, not missing from a synchronization failure.

Practice this question →
14
MCQmedium

During an HA failover, the new active firewall's session table is empty, causing all existing connections to be dropped. Which configuration change would prevent this?

A.Configure HA3 for stateful inspection.
B.Increase HA1 keepalive timer.
C.Enable config sync on HA1.
D.Enable session sync on HA2.
AnswerD

Session sync ensures sessions are replicated to the passive firewall.

Why this answer

Enabling session sync on the HA2 link ensures that session state information is continuously replicated from the active firewall to the standby firewall. During a failover, the new active firewall already has the session table populated, so existing connections are preserved and not dropped. Without session sync, the standby firewall starts with an empty session table, causing all existing TCP/UDP sessions to be torn down.

Exam trap

The trap here is confusing configuration synchronization (config sync) with session state synchronization (session sync), leading candidates to incorrectly select config sync on HA1 as the solution for preserving active connections during failover.

How to eliminate wrong answers

Option A is wrong because HA3 is the management link used for control-plane traffic like configuration synchronization and keepalives, not for session state synchronization; stateful inspection is a firewall feature unrelated to HA session sync. Option B is wrong because increasing the HA1 keepalive timer only affects how quickly the firewall detects a peer failure, but does not prevent session loss after failover; it may actually delay failover detection. Option C is wrong because config sync on HA1 synchronizes configuration objects (policies, objects) between peers, not dynamic session state; session tables are not part of configuration sync.

Practice this question →
15
Matchingmedium

Match each CLI command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Displays firewall model, version, and uptime

Lists currently active security rules

Reboots the firewall

Captures packets for troubleshooting

Enters configuration mode to make changes

Why these pairings

These are common commands used in PAN-OS CLI. Correct matches are: show system info shows system information, request restart system restarts the system, show running configuration shows the current config. 'request commit' commits changes, and 'show interface all' shows interfaces.

Practice this question →
16
Multi-Selectmedium

Which TWO of the following are prerequisites for configuring high availability on Palo Alto Networks firewalls? (Choose two.)

Select 2 answers
A.Both firewalls must have management IPs in different subnets
B.Both firewalls must have the same interface naming
C.Both firewalls must have the same licenses
D.Both firewalls must run the same software version
E.Both firewalls must be the same model
AnswersD, E

Same PAN-OS version is required.

Why this answer

Both firewalls in a high availability (HA) pair must run the same PAN-OS software version to ensure configuration synchronization and stateful failover compatibility. The HA synchronization process uses the HA2 link to replicate configurations and session state, and version mismatches can cause sync failures or unexpected behavior during failover.

Exam trap

A common pitfall is assuming that different models can form an HA pair as long as they run the same PAN‑OS version, but Palo Alto Networks requires both firewalls to be the exact same model for HA.

Practice this question →
17
MCQhard

A company has two Palo Alto Networks firewalls configured in an active/passive HA pair. During a failover test, the passive firewall becomes active, but traffic stops passing through the new active firewall. The management interface on the new active firewall is reachable. What is the most likely cause?

A.The ARP table was not synchronized during failover.
B.The HA2 link is down, causing session table mismatch.
C.The new active firewall does not have a valid license.
D.The session setup rate exceeded the new active firewall's capacity.
AnswerD

If the session setup rate is too high, the firewall may drop new sessions while still being manageable.

Why this answer

When a passive firewall becomes active, it must process all new session setups from scratch. If the session setup rate exceeds the new active firewall's capacity (e.g., due to licensing limits on session count or throughput), traffic will be dropped even though the management interface remains reachable. The management plane is separate from the data plane, so management access can still work while forwarding fails.

Exam trap

The trap here is that candidates often assume a management interface being reachable means the data plane is fully operational, but in Palo Alto firewalls, the management plane and data plane are independent; a license or capacity limit can block data forwarding while management remains accessible.

How to eliminate wrong answers

Option A is wrong because ARP tables are synchronized via HA1 (control link) during failover, and the new active firewall would learn ARP entries from the active firewall's forwarding table; a missing ARP table would cause local connectivity issues but not a complete traffic stop. Option B is wrong because the HA2 link is used for session synchronization, but even if it is down, the new active firewall would still have its own session table from before failover; a mismatch would not prevent all traffic from passing. Option C is wrong because license validity is checked at boot time and does not affect ongoing traffic forwarding; the firewall would still pass traffic even without a valid license, though it might restrict certain features.

Practice this question →
18
MCQeasy

When configuring High Availability on a Palo Alto Networks firewall, which of the following is a best practice for the HA1 control link?

A.Use the management interface (MGT) for HA1
B.Configure HA1 as a subinterface on the HA2 link
C.Configure HA1 over a VLAN on a data interface to save ports
D.Use a dedicated physical interface for HA1, not shared with data traffic
AnswerD

Dedicated interface ensures stable heartbeat.

Why this answer

The HA1 control link carries critical heartbeat and synchronization traffic between the two firewalls in an active/passive or active/active HA pair. Using a dedicated physical interface ensures that control traffic is isolated from data traffic, preventing congestion or interference that could cause false failovers or synchronization delays. The management interface (MGT) is not recommended for HA1 because it shares the control plane CPU and can be overwhelmed by management traffic, leading to HA instability.

Exam trap

The trap here is that candidates often assume the MGT interface is acceptable for HA1 because it is a separate interface, but Palo Alto Networks explicitly recommends against it due to control plane resource contention and the risk of HA failure during management spikes.

How to eliminate wrong answers

Option A is wrong because the MGT interface is designed for out-of-band management and should not be used for HA1; it shares the control plane CPU and can cause HA heartbeat failures under heavy management load. Option B is wrong because HA1 cannot be configured as a subinterface on the HA2 link; HA2 is a dedicated data link for session and state synchronization, and subinterfaces are not supported for HA control traffic. Option C is wrong because configuring HA1 over a VLAN on a data interface violates the best practice of isolating control traffic; data interface VLANs carry user traffic and can introduce latency or packet loss that disrupts HA heartbeat timing.

Practice this question →
19
MCQeasy

An HA pair is configured with Active/Passive mode. The passive firewall fails to become active after the active firewall's management interface goes down. What is the most likely cause?

A.HA1 keepalive failure is not detected
B.Management interface failure is not a monitored condition by default
C.HA2 link monitoring is not enabled
D.Session synchronization is not complete
AnswerB

Management interface down does not trigger HA failover unless explicitly configured under device HA.

Why this answer

In an Active/Passive HA pair, the passive firewall monitors the active firewall's liveness via the HA1 control link. By default, only the HA1 link failure triggers a failover; the management interface is not monitored for HA state transitions. Therefore, if the management interface goes down but the HA1 link remains up, the passive firewall does not detect a failure and will not become active.

Exam trap

The trap here is that candidates assume any interface failure triggers HA failover, but Palo Alto Networks HA only monitors interfaces explicitly configured as monitored interfaces; the management interface is not monitored by default.

How to eliminate wrong answers

Option A is wrong because HA1 keepalive failure is detected via the HA1 control link; if the management interface goes down but HA1 remains up, keepalives continue, so no failure is detected. Option C is wrong because HA2 link monitoring is used for data link path monitoring and session synchronization, not for triggering failover in Active/Passive mode; failover is based on HA1 keepalive failure or monitored interface failure, not HA2. Option D is wrong because session synchronization completeness does not affect failover triggering; the passive firewall will not become active unless it detects a failure condition, regardless of sync state.

Practice this question →
20
MCQmedium

A company has two Palo Alto Networks firewalls configured in active/passive HA. During a failover test, the passive firewall becomes active but traffic is not passing. The active firewall shows the correct configuration and licenses. Which action is most likely to resolve the issue?

A.Enable preemption on the HA configuration.
B.Re-apply the licenses on the newly active firewall.
C.Perform a configuration synchronization from the original active firewall.
D.Disable the HA2 link to force stateful failover.
AnswerC

The passive may have an outdated or incomplete config; sync ensures it matches the active.

Why this answer

The most likely cause of traffic failure after a failover is that the configuration on the newly active firewall is out of sync with the original active firewall. In active/passive HA, configuration synchronization (config sync) is typically enabled, but if it was not performed before the failover or if the passive device had a stale configuration, critical settings such as interface IPs, security policies, or routing entries may be missing or incorrect. Performing a configuration synchronization from the original active firewall ensures the new active device has the exact same configuration, restoring traffic flow.

Exam trap

The trap here is that candidates often assume a failover automatically includes full configuration synchronization, but in reality, config sync must be explicitly enabled and successfully completed beforehand, and a stale passive device will not pass traffic until a manual sync is performed.

How to eliminate wrong answers

Option A is wrong because preemption controls which device becomes active after a failure is resolved, not the ability to pass traffic during a failover; it does not fix a configuration mismatch. Option B is wrong because licenses are shared in an HA pair and do not need to be re-applied after failover; the passive firewall already has the same licenses as the active device. Option D is wrong because disabling the HA2 link would break the state synchronization and heartbeat path, potentially causing both firewalls to become active (split-brain) or losing session state, which would not resolve a configuration issue and would worsen the problem.

Practice this question →
21
MCQhard

After a power failure, both firewalls in an HA pair come up and report 'active' state. The network team confirms that the two firewalls are connected via HA1 and HA2. What is the most likely cause of the split-brain condition?

A.The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state
B.The active firewall has a higher software version
C.Preemption is enabled on both firewalls
D.HA2 link is configured but not used for election
AnswerA

A short hold timer can lead to premature failover during boot.

Why this answer

The HA1 keepalive hold timer determines how long a firewall waits for a hello message from its peer before declaring it dead. If this timer is set too low, both firewalls may boot up and not receive each other's initial keepalives in time, causing each to assume the other is unavailable and transition to active state. This results in a split-brain condition where both firewalls operate independently.

Exam trap

The trap here is that candidates often confuse the HA1 keepalive timer with the HA2 link's role in election, assuming HA2 is involved in determining active/passive state, when in fact HA2 is only for session synchronization and not for election.

How to eliminate wrong answers

Option B is wrong because mismatched software versions would prevent the HA pair from forming at all (the firewalls would not synchronize or become active together), not cause both to become active after a power failure. Option C is wrong because preemption controls which firewall becomes active after a failover when the original active returns, not the initial election after a power failure; enabling preemption on both would not cause split-brain. Option D is wrong because the HA2 link is used for data synchronization and state propagation, not for election; election is handled exclusively over HA1, so HA2 being unused does not cause split-brain.

Practice this question →
22
MCQhard

In an Active/Passive HA pair, the passive firewall reports 'non-functional' state. The 'show high-availability state' output on the passive shows 'state: non-functional' and 'reason: configuration mismatch'. The active firewall shows 'state: active' and 'reason: no reason'. Which action should be taken to resolve the issue without disrupting traffic?

A.Run 'request high-availability sync-to-remote' from the active firewall
B.Restart the HA process on the passive firewall with 'debug software restart high-availability'
C.Failover the active firewall to force re-sync
D.Upgrade both firewalls to the same PAN-OS version
AnswerA

This synchronizes the active configuration to the passive without downtime.

Why this answer

The 'configuration mismatch' error indicates that the configuration databases on the active and passive firewalls are out of sync. Running 'request high-availability sync-to-remote' from the active firewall pushes the active configuration to the passive firewall without disrupting traffic, as it only updates the passive unit's configuration and does not trigger a failover or restart.

Exam trap

The trap here is that candidates often assume a 'non-functional' state requires a restart or failover, but the specific 'configuration mismatch' reason points to a sync issue that can be resolved non-disruptively with a configuration push from the active firewall.

How to eliminate wrong answers

Option B is wrong because restarting the HA process on the passive firewall does not resolve a configuration mismatch; it only restarts the HA state machine and may temporarily disrupt HA communication without syncing the configuration. Option C is wrong because failing over the active firewall would force a traffic disruption by switching the active role to the passive unit, which is in a non-functional state, potentially causing a full outage. Option D is wrong because the issue is a configuration mismatch, not a PAN-OS version mismatch; upgrading both firewalls would not fix the configuration discrepancy and could introduce unnecessary downtime.

Practice this question →
23
MCQhard

An HA pair is configured with active/active mode and session sync enabled. After a failover, a network administrator notices that some new TCP connections fail. The firewall logs show no drops. What is the most likely issue?

A.The ARP cache on the firewalls is stale
B.Flow-based routing is misconfigured
C.Session synchronization is not functioning for TCP
D.Asymmetric routing is causing the SYN packet to be processed by one firewall and the SYN-ACK by the other
AnswerD

Active/active requires careful design to ensure symmetric traffic flows.

Why this answer

In an active/active HA pair with session sync enabled, asymmetric routing can occur after a failover if the traffic flow changes such that the SYN packet is processed by one firewall and the SYN-ACK by the other. Since session sync only synchronizes established sessions, not half-open ones, the firewall receiving the SYN-ACK does not have a session entry for the SYN, causing it to drop the SYN-ACK as a non-SYN packet without a session. The firewall logs show no drops because the drop occurs at the session lookup stage and may not be logged by default, or the drop counter is not incremented for this specific scenario.

Exam trap

The trap here is that candidates assume session sync covers all TCP packets, including the initial handshake, but in reality, session sync only replicates established sessions, not half-open ones, making asymmetric routing during the handshake a critical failure point.

How to eliminate wrong answers

Option A is wrong because stale ARP cache would cause connectivity issues for all traffic, not just new TCP connections, and would typically result in drops or timeouts visible in logs. Option B is wrong because flow-based routing is not a standard feature in Palo Alto Networks firewalls; routing decisions are based on the routing table, not flow-based, and misconfiguration would affect all traffic, not specifically new TCP connections after failover. Option C is wrong because session synchronization is functioning for TCP by design in active/active mode, but it only synchronizes established sessions after the three-way handshake completes; the issue is that the SYN and SYN-ACK are not synchronized because they occur before the session is established.

Practice this question →
24
Drag & Dropmedium

Arrange the steps to enable and configure GlobalProtect on a Palo Alto Networks firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence for enabling and configuring GlobalProtect on a Palo Alto Networks firewall starts with configuring the portal, which handles authentication and client settings. Next, the gateway is configured to manage VPN connections. Then, the GlobalProtect agent (client configuration) is set up to push settings to endpoints.

Finally, security policies are applied to allow GlobalProtect traffic. Following this order ensures dependencies are satisfied and reduces configuration errors.

Practice this question →
25
MCQhard

An HA pair is deployed with Active/Active mode. During a traffic spike, session table utilization reaches 90% on both firewalls. The engineer notices asymmetric routing and drops. What should be configured to optimize session distribution?

A.Change the HA mode to Active/Passive
B.Adjust the session distribution algorithm to match traffic patterns
C.Increase the HA2 link bandwidth using link aggregation
D.Enable session synchronization for all sessions
AnswerB

Proper distribution reduces asymmetric routing.

Why this answer

In an Active/Active HA pair, session distribution is controlled by a hash-based algorithm that determines which firewall handles a given flow. When asymmetric routing and drops occur during high session utilization, the default algorithm may not distribute traffic evenly, causing one firewall to become overloaded. Adjusting the session distribution algorithm (e.g., from IP hash to round-robin or a weighted distribution) can better match the traffic patterns and balance the load, reducing asymmetry and drops.

Exam trap

The trap here is that candidates often assume increasing HA2 bandwidth or enabling session synchronization will fix load imbalance, but these address sync throughput, not the root cause of uneven session distribution.

How to eliminate wrong answers

Option A is wrong because changing to Active/Passive would eliminate the load-sharing benefit of Active/Active, leaving one firewall idle and potentially still causing drops on the active unit during a traffic spike. Option C is wrong because increasing HA2 link bandwidth (used for session synchronization and state propagation) does not affect how sessions are initially distributed; it only improves the throughput of sync traffic, not the load-balancing algorithm. Option D is wrong because session synchronization is already enabled by default in Active/Active mode to maintain state; enabling it for all sessions does not change the distribution algorithm and will not optimize how sessions are assigned to firewalls.

Practice this question →
26
Multi-Selecthard

Which TWO troubleshooting steps are most effective when an HA pair is not synchronizing sessions between peers? (Assume HA1 and HA2 are up.)

Select 2 answers
A.Ensure session synchronization is enabled on both firewalls under Device > High Availability > Setup
B.Check HA1 link utilization
C.Increase the packet buffer protection threshold
D.Review the session synchronization configuration for mismatched parameters (e.g., encryption, timeout)
E.Restart the HA process on both firewalls
AnswersA, D

If disabled, no sync occurs.

Why this answer

The two most effective troubleshooting steps are A and D. A is correct because if session synchronization is disabled, sessions will not sync. Under Device > High Availability > Setup, you must verify that session synchronization is enabled on both firewalls.

D is correct because mismatched parameters such as encryption, timeout, or other session sync settings can prevent synchronization. B is wrong because HA1 link utilization does not directly affect session synchronization; HA1 is for control traffic, and session data is sent over HA2 or HA3. C is wrong: increasing the packet buffer protection threshold is for buffer exhaustion issues, not session synchronization.

E is wrong: restarting the HA process is a disruptive step and should only be attempted after verifying other settings; it is not a primary troubleshooting step.

Practice this question →
27
MCQhard

The firewall is in passive state. The network team reports that during a recent maintenance window, the active firewall lost its upstream link but the passive firewall did not take over. Based on the exhibit, what is the most likely reason?

A.HA2 heartbeat link is down, preventing the passive from detecting the active's failure.
B.The fail-holdup timer is set to 0, causing immediate failover but not triggered.
C.Link monitoring is enabled but not configured to monitor the specific interface that failed.
D.Path monitoring is disabled so the passive does not monitor connectivity to the upstream router.
AnswerC

Link monitoring must include the interface; otherwise, its state change is ignored for failover decisions.

Why this answer

Link monitoring on a Palo Alto Networks firewall is configured to monitor specific interfaces. If the upstream link that failed is not included in the link monitoring group, the passive firewall will not detect the loss of that link and will not trigger a failover. The passive firewall only monitors the interfaces explicitly listed under Device > High Availability > Link Monitoring, so an unmonitored interface failure will be ignored for HA purposes.

Exam trap

The trap here is that candidates confuse link monitoring (local interface state) with path monitoring (remote reachability) or assume the HA2 heartbeat link is responsible for failure detection, when in fact HA1 keepalives handle that and link monitoring is the feature that must explicitly include the failed interface.

How to eliminate wrong answers

Option A is wrong because the HA2 heartbeat link is used for session synchronization and state propagation, not for detecting link failures; the passive detects active failure via HA1 keepalive packets, not HA2. Option B is wrong because the fail-holdup timer (default 0) controls how long the passive waits before taking over after detecting a failure, but it does not prevent detection of the failure itself; the issue here is that the failure was never detected. Option D is wrong because path monitoring is a separate feature that monitors connectivity to specific destination IP addresses (e.g., next-hop routers), not the state of local interfaces; disabling path monitoring would not prevent the passive from detecting a local interface failure, which is the domain of link monitoring.

Practice this question →
28
Multi-Selecthard

An engineer is troubleshooting an HA pair where session synchronization is not working. Which THREE steps should be taken to diagnose the issue? (Choose three.)

Select 3 answers
A.Verify that the HA2 link is operationally up
B.Check the session synchronization status using 'show running session-sync'
C.Check the HA1 link status using 'show high-availability state'
D.Review the system logs for session sync errors
E.Enable flow-based routing on both firewalls
AnswersA, B, D

HA2 is used for session synchronization.

Why this answer

The HA2 link is the dedicated link for session synchronization in a Palo Alto Networks HA pair. If the HA2 link is not operationally up, session state information cannot be exchanged between the firewalls, causing synchronization to fail. Verifying the HA2 link status is a fundamental first step in troubleshooting session sync issues.

Exam trap

The trap here is that candidates often confuse the HA1 and HA2 links, assuming that checking the HA1 link status (which handles heartbeats) will reveal session sync issues, when in fact only the HA2 link is responsible for session synchronization.

Practice this question →
29
MCQmedium

A firewall in an HA pair is being upgraded. The administrator wants to minimize traffic loss. What is the recommended procedure for upgrading the passive firewall in an active/passive pair?

A.Upgrade the active firewall first, then failover to the passive
B.Upgrade the passive firewall, failover to it, then upgrade the original active
C.Suspend HA, upgrade both, then re-enable HA
D.Upgrade both firewalls simultaneously after disconnecting HA links
AnswerB

This ensures minimal traffic loss.

Why this answer

In an active/passive HA pair, the passive firewall is upgraded first while the active firewall continues to handle traffic. After the passive firewall is upgraded and rebooted, an administrative failover is performed to make it the new active firewall, minimizing traffic loss. The original active firewall is then upgraded, ensuring there is always a firewall processing traffic during the upgrade process.

Exam trap

The trap here is that candidates often assume upgrading the active firewall first is safer because it is the primary device, but this ignores the fact that the passive firewall must be upgraded and ready to take over before the active firewall is touched to avoid traffic loss.

How to eliminate wrong answers

Option A is wrong because upgrading the active firewall first would cause traffic disruption during its reboot, as the passive firewall is not yet upgraded and may not be able to take over seamlessly. Option C is wrong because suspending HA breaks the synchronization and state sharing, leaving the network unprotected during the upgrade and requiring manual reconfiguration, which increases the risk of traffic loss. Option D is wrong because upgrading both firewalls simultaneously after disconnecting HA links leaves no firewall protecting the network, causing complete traffic loss until at least one firewall is back online.

Practice this question →
30
MCQhard

Refer to the exhibit. Based on the log, what triggered the failover?

A.Loss of HA1 heartbeat from the peer
B.A link failure on ethernet1/1
C.An administrator manually triggered a failover
D.A path monitoring group determined that the upstream ISP is unreachable
AnswerD

The log explicitly states path monitoring group failure.

Why this answer

The log entry indicates that the failover was triggered by a path monitoring group, which detected that the upstream ISP became unreachable. Path monitoring actively probes the next-hop gateway or a target IP address; when the probe fails, the firewall considers the path down and initiates a failover to the passive peer. This is distinct from HA1 heartbeat loss or link failure, as the log explicitly references the path monitoring group.

Exam trap

The trap here is that candidates often confuse path monitoring with simple link monitoring or HA1 heartbeat loss, but the log entry's explicit reference to a 'path monitoring group' is the key differentiator that points to upstream unreachability rather than local interface or HA communication issues.

How to eliminate wrong answers

Option A is wrong because loss of HA1 heartbeat would generate a log entry referencing 'HA1 heartbeat timeout' or 'HA1 link down', not a path monitoring group event. Option B is wrong because a link failure on ethernet1/1 would produce a log entry for 'link down' or 'interface down', not a path monitoring group action. Option C is wrong because an administrator manually triggering a failover would show a log entry like 'admin requested failover' or 'manual failover', not a path monitoring group event.

Practice this question →
31
Multi-Selectmedium

Which THREE steps should be taken to verify that an HA pair is ready for a scheduled failover?

Select 3 answers
A.Stop all logging to reduce CPU load
B.Perform a 'show high-availability sync-status' to confirm config synchronization
C.Verify HA2 link status is up
D.Confirm that session synchronization is enabled
E.Disable preemption on the active firewall
AnswersB, C, D

Config sync must be complete for consistency.

Why this answer

The 'show high-availability sync-status' command directly verifies that the configuration is synchronized between the HA pair, which is essential for a consistent state during failover. Without config sync, the passive firewall may not have the same policies or objects, leading to traffic drops or security gaps after failover.

Exam trap

The trap here is that candidates may confuse preemption or logging adjustments with verification steps, but the PCNSE exam expects you to know that only configuration sync, HA2 link status, and session sync are direct checks for HA readiness before a scheduled failover.

Practice this question →
32
MCQeasy

An administrator notices that the HA pair shows a state mismatch: one firewall reports active, the other reports passive, but traffic is not flowing through the active firewall. What is the most likely cause?

A.Session synchronization is incomplete
B.The HA2 link is down
C.The passive firewall has a higher priority
D.The HA1 link is down and preemptive mode is enabled
AnswerD

With HA1 down and preemptive, both may attempt to become active, leading to mismatch.

Why this answer

When the HA1 link is down and preemptive mode is enabled, each firewall may operate independently, leading to a state mismatch where one reports active and the other passive. Traffic does not flow through the active firewall because it lacks the HA1 communication to validate the peer's state. Option A is incorrect because incomplete session synchronization does not cause a state mismatch; it only affects session redundancy.

Option B is incorrect because the HA2 link is for session synchronization, not for state determination; a failure would not cause a state mismatch. Option C is incorrect because priority determines which firewall becomes active/passive but does not cause a mismatch; if the passive had higher priority, it would be active.

Practice this question →
33
MCQmedium

An engineer notices that the HA pair is not synchronizing configuration changes. The 'show high-availability sync-status' output shows 'sync-failure'. What is the first step to troubleshoot?

A.Verify HA1 link status and IP connectivity between peers
B.Disable preemption on the active firewall
C.Check the HA2 link session synchronization status
D.Reboot both firewalls to clear the failure
AnswerA

HA1 is used for configuration synchronization.

Why this answer

The 'sync-failure' status on the 'show high-availability sync-status' output indicates that configuration synchronization between the HA peers has failed. The first step in troubleshooting is to verify the HA1 link status and IP connectivity between peers because HA1 is the dedicated control link used for heartbeats and configuration sync. Without a functional HA1 link, the firewalls cannot exchange configuration data, making this the most fundamental check before investigating other potential causes.

Exam trap

The trap here is that candidates often jump to checking the HA2 link (session synchronization) because they confuse configuration sync with stateful session sync, but HA1 is the correct link for configuration changes.

How to eliminate wrong answers

Option B is wrong because disabling preemption does not address the underlying connectivity or sync mechanism; preemption controls which firewall becomes active after a failure, not the synchronization of configurations. Option C is wrong because the HA2 link is used for session synchronization (stateful failover), not for configuration synchronization; checking HA2 would be relevant for session sync issues, not config sync failures. Option D is wrong because rebooting both firewalls is a drastic and unnecessary step that could cause service disruption; it should only be considered after verifying basic connectivity and link status, as a reboot will not fix a fundamental HA1 link problem.

Practice this question →
34
MCQhard

In an HA active/passive setup, the engineer wants to ensure that during a failover, existing FTP data sessions are not interrupted. What additional configuration is required beyond default session synchronization?

A.Use HA3 link for session synchronization
B.Enable asymmetric routing support
C.Enable UDP session synchronization
D.Configure an application layer gateway (ALG) for FTP
AnswerD

ALG ensures FTP control and data sessions remain intact.

Why this answer

FTP uses separate control and data channels, and the data channel port is dynamically negotiated via the PORT or PASV command. Without an application layer gateway (ALG) for FTP, the firewall cannot track these dynamic ports, so session synchronization would only replicate the control session, causing data sessions to drop after a failover. Enabling the FTP ALG ensures the firewall inspects FTP commands and creates the necessary pinholes for data sessions, which are then synchronized to the passive peer.

Exam trap

The trap here is that candidates assume session synchronization alone is sufficient for all TCP sessions, overlooking that FTP's dynamic port negotiation requires application-layer inspection to create and sync the data channel sessions.

How to eliminate wrong answers

Option A is wrong because the HA3 link is used for state synchronization and session table updates, but it does not address the protocol-specific issue of FTP's dynamic data ports; session synchronization alone cannot preserve FTP data sessions without ALG support. Option B is wrong because asymmetric routing support handles scenarios where traffic takes different paths inbound and outbound, but it does not solve the problem of FTP data sessions being dynamically negotiated and not tracked by default session sync. Option C is wrong because UDP session synchronization is irrelevant to FTP, which uses TCP for both control and data channels; enabling UDP sync would not help preserve FTP data sessions.

Practice this question →
35
MCQhard

Refer to the exhibit. An active/active HA pair shows the local firewall as active-secondary. The last failover reason is 'path-group-down'. What should the administrator investigate first?

A.Inspect the session table for asymmetric routing between the firewalls.
B.Verify the link status of interface ethernet1/2 and its association with the path monitoring group.
C.Ensure the HA2 link is properly connected and firewalls can synchronize sessions.
D.Check the HA priority settings to ensure the local firewall should be active-secondary.
AnswerB

The link is down, and if it is used for path monitoring, it could cause the path group to go down.

Why this answer

The 'path-group-down' failover reason indicates that the firewall detected a failure in a monitored path group, which is associated with specific interfaces. Option B is correct because the administrator should first verify the link status of interface ethernet1/2 and its association with the path monitoring group, as this directly addresses the root cause of the failover trigger. Path monitoring is used to detect upstream connectivity loss and can cause a firewall to transition to active-secondary if the monitored path fails.

Exam trap

The trap here is that candidates often confuse 'path-group-down' with HA link failures or session synchronization issues, leading them to investigate HA2 links or session tables instead of the specific interface and path monitoring configuration.

How to eliminate wrong answers

Option A is wrong because asymmetric routing between firewalls would typically cause session setup failures or session timeouts, not a 'path-group-down' failover reason; path monitoring is independent of session table symmetry. Option C is wrong because the HA2 link is used for session synchronization and state propagation, but a 'path-group-down' failover is triggered by path monitoring, not by HA2 link failure; an HA2 link failure would show a different failover reason such as 'ha2-link-down'. Option D is wrong because HA priority settings determine which firewall becomes active-primary or active-secondary during initial election or preemption, but the 'path-group-down' reason indicates a dynamic failover due to a path monitoring event, not a priority mismatch.

Practice this question →
36
MCQhard

Based on the exhibit, what is the most likely cause of the warnings?

A.The HA3 link is misconfigured
B.Configuration synchronization is failing
C.Both the primary and backup HA2 links are down
D.The HA2 keepalive timer is set too low
AnswerC

Warnings for both indicate link failure.

Why this answer

The exhibit shows warnings indicating that both the primary and backup HA2 links are down. HA2 is the control link used for session synchronization and configuration state exchange in an active/passive or active/active firewall pair. When both HA2 links fail, the firewalls cannot synchronize session tables, leading to warnings about potential asymmetric traffic and failover issues.

Option C correctly identifies this as the most likely cause.

Exam trap

The trap here is that candidates often confuse HA2 (control link) with HA3 (data link) or assume that a single link failure is the cause, but the exhibit explicitly shows warnings for both primary and backup HA2 links being down, making C the only correct answer.

How to eliminate wrong answers

Option A is wrong because the HA3 link is the dataplane link used for forwarding traffic in active/active mode or for asymmetric routing; misconfiguration of HA3 would cause traffic forwarding issues, not the specific warnings shown. Option B is wrong because configuration synchronization failing would typically generate a different set of warnings related to config mismatch or sync failure, not the HA2 link down warnings. Option D is wrong because the HA2 keepalive timer being set too low would cause flapping or false failovers, but the exhibit shows persistent warnings indicating the links are down, not intermittent keepalive failures.

Practice this question →
37
MCQeasy

What is the recommended best practice for the HA2 keepalive timer in an active/passive HA configuration?

A.2000 ms
B.It should be left at the default value and not changed
C.500 ms
D.1000 ms
AnswerD

Default and recommended for stability.

Why this answer

In an active/passive HA configuration, the HA2 keepalive timer should be set to 1000 ms (1 second) as a best practice. This value provides a balance between fast failover detection and network stability, ensuring that the passive firewall can detect a failure of the active firewall within a reasonable timeframe without causing false positives due to transient network issues.

Exam trap

The trap here is that candidates may confuse the HA2 keepalive timer with the HA1 backup link timer or assume a lower value always improves performance, ignoring the risk of false failovers due to network jitter.

How to eliminate wrong answers

Option A (2000 ms) is wrong because a 2-second keepalive timer is too slow for active/passive HA, potentially delaying failover beyond acceptable limits for critical traffic. Option B (default value) is wrong because the default HA2 keepalive timer is typically 1000 ms, so leaving it unchanged actually matches the recommended best practice, but the option implies not changing it from a non-default value, which is misleading; the correct practice is to ensure it is set to 1000 ms, not to leave it at an unspecified default. Option C (500 ms) is wrong because a 500 ms timer is too aggressive, increasing the risk of false failovers due to minor network jitter or transient delays, which can destabilize the HA pair.

Practice this question →
38
Multi-Selecteasy

Which TWO conditions can cause an HA pair to show a state of 'suspended'?

Select 2 answers
A.Software version mismatch between peers
B.HA2 link failure
C.License mismatch between peers
D.Configuration synchronization failure
E.HA1 link failure
AnswersD, E

If config sync fails, firewall may suspend to avoid inconsistency.

Why this answer

A configuration synchronization failure causes the HA pair to enter a 'suspended' state. When configuration sync fails, the passive peer cannot apply the active peer's configuration, breaking the synchronization requirement for HA operation. The suspended state prevents the passive peer from taking over until the configuration mismatch is resolved.

Exam trap

The trap here is that candidates often assume that link failures only cause 'non-functional' states, but in the PCNSE exam, an HA1 link failure specifically triggers the 'suspended' state because the control link is down. Configuration synchronization failure is the other cause. Candidates may incorrectly think that HA2 link failure or license/version mismatches cause suspended state, but they do not.

Practice this question →
39
MCQeasy

A company has deployed two PA-3220 firewalls in an active/passive high availability configuration. During normal operation, the active firewall (FW-A) handles all traffic. The network team notices that after a brief power outage, both firewalls report as active in the HA pair, causing network instability. The administrator needs to resolve this issue and prevent it from recurring. Which course of action should the administrator take?

A.Reboot both firewalls simultaneously to reset the HA state.
B.Disable link speed and duplex settings on the HA interfaces to force a failover.
C.Configure the HA mode with the 'preemptive' option and set the device priority higher on the intended active firewall.
D.Set the HA mode to 'active/active' to allow both firewalls to process traffic.
AnswerC

Preemptive ensures the higher-priority device becomes active after recovery, preventing both firewalls from staying active.

Why this answer

Configuring the HA mode with the 'preemptive' option ensures that when both firewalls recover from a power outage, the firewall with the higher device priority (the intended active unit) will automatically preempt the other and become active. Without preemption, both firewalls may come up as active if they lose HA heartbeat synchronization during the outage, leading to a split-brain scenario. Setting the device priority higher on FW-A guarantees it is preferred as the active unit upon recovery.

Exam trap

The trap here is that candidates often assume rebooting or resetting the HA state (Option A) is sufficient, but they overlook the need for preemption to automatically resolve the split-brain condition after a power failure, which is a common cause of HA instability in production environments.

How to eliminate wrong answers

Option A is wrong because rebooting both firewalls simultaneously does not resolve the underlying split-brain condition; it only temporarily resets the HA state and the problem will recur if the root cause (lack of preemption) is not addressed. Option B is wrong because disabling link speed and duplex settings on HA interfaces would disrupt the HA heartbeat link, potentially causing both firewalls to assume active state due to loss of communication, which worsens the issue rather than fixing it. Option D is wrong because setting the HA mode to 'active/active' would allow both firewalls to process traffic simultaneously, which is not the intended design for this active/passive deployment and would cause asymmetric routing and network instability, not resolve the split-brain problem.

Practice this question →
40
MCQeasy

An administrator needs to verify the health of HA links. Which CLI command displays the current status of HA1, HA2, and HA3 links?

A.show session info
B.show running np-ips
C.show device-info
D.show high-availability state
AnswerD

Displays HA status including link states.

Why this answer

The 'show high-availability state' command is the correct CLI command to verify the health of HA1, HA2, and HA3 links because it displays the current status, link state, and any failures for each HA link in a Palo Alto Networks firewall. This command provides a comprehensive view of the HA control link (HA1), data link (HA2), and backup link (HA3), including their operational status and packet statistics, which is essential for troubleshooting high-availability configurations.

Exam trap

The trap here is that candidates often confuse 'show high-availability state' with 'show device-info' or 'show session info', assuming general system or session data includes HA link details, but only the dedicated HA command provides the granular link status required for this verification.

How to eliminate wrong answers

Option A is wrong because 'show session info' displays information about active sessions, such as source/destination IPs and ports, not the status of HA links. Option B is wrong because 'show running np-ips' shows the running configuration of network processor IP addresses, which is unrelated to HA link health verification. Option C is wrong because 'show device-info' provides general system information like model, serial number, and uptime, but does not include the specific status of HA1, HA2, or HA3 links.

Practice this question →
41
MCQeasy

After upgrading the software on an HA pair, the two firewalls report different HA states. Which command should be used to quickly verify the HA configuration synchronization status?

A.show high-availability pending-changes
B.show high-availability state
C.show high-availability sync-status
D.show high-availability link-monitoring
AnswerC

Displays config sync status between peers.

Why this answer

The 'show high-availability sync-status' command specifically displays the synchronization status of the configuration between HA peers, including whether the active and passive firewalls are in sync, the last sync time, and any pending changes. After a software upgrade, configuration mismatches can occur due to version differences or failed syncs, and this command directly verifies if the configurations are synchronized.

Exam trap

PCNSE candidates often confuse the HA state (active/passive) with configuration synchronization status. The 'show high-availability state' command shows the operational state, not the sync status. After a software upgrade, verifying configuration sync is critical, making 'show high-availability sync-status' the correct command.

How to eliminate wrong answers

Option A is wrong because 'show high-availability pending-changes' shows configuration changes that have been made on the local firewall but not yet committed, not the synchronization status between HA peers. Option B is wrong because 'show high-availability state' displays the current HA operational state (e.g., active, passive, non-functional) and peer information, but does not show whether the configurations are synchronized. Option D is wrong because 'show high-availability link-monitoring' shows the status of monitored HA links and interfaces, not the configuration synchronization status.

Practice this question →
42
MCQmedium

During a failover test, an engineer observes that after the active firewall fails, the passive firewall takes over, but existing UDP sessions are not maintained. What is the most likely reason?

A.The HA pair is in active/active mode
B.The failover delay timer is too long
C.UDP sessions are not synchronized by default in active/passive mode
D.Session synchronization is disabled on the passive firewall
AnswerC

Only TCP sessions are synced by default; UDP sessions require additional configuration.

Why this answer

In an active/passive HA pair, session synchronization is enabled by default for TCP sessions but not for UDP sessions. UDP is considered connectionless, and the firewall does not maintain state information for UDP flows in the same way as TCP. Therefore, when a failover occurs, existing UDP sessions are not preserved because their state was never synchronized to the passive firewall.

Exam trap

The trap here is that candidates assume all sessions are synchronized by default in active/passive HA, but the PCNSE exam specifically tests the nuance that UDP sessions are not synchronized unless explicitly configured.

How to eliminate wrong answers

Option A is wrong because active/active mode does not affect session synchronization behavior for UDP; in fact, active/active mode also synchronizes sessions, but the issue here is specific to UDP not being synced by default. Option B is wrong because the failover delay timer controls how long the passive firewall waits before taking over, not whether sessions are synchronized or maintained. Option D is wrong because session synchronization is enabled by default on the passive firewall in active/passive mode; the problem is that UDP sessions are not included in that synchronization by default.

Practice this question →
43
MCQmedium

Based on the exhibit, what caused the last failover?

A.The HA2 link went down.
B.A preemption event occurred.
C.The peer firewall was rebooted.
D.The HA1 keepalive from the peer was lost.
AnswerD

The output shows 'last failure reason: peer HA1 keepalive lost'.

Why this answer

The exhibit shows 'HA1 keepalive from the peer was lost' as the last failover reason. In an active/passive HA pair, the passive firewall monitors HA1 keepalive messages from the active peer. When these keepalives are not received within the configured hello interval (default 1 second) and hold timer (default 3 seconds), the passive firewall assumes the active peer has failed and initiates a failover to become active.

Exam trap

The trap here is that candidates often confuse the HA1 link (control link for keepalives) with the HA2 link (data link for session sync), leading them to incorrectly select Option A when the actual failover trigger is loss of HA1 keepalive, not HA2 link failure.

How to eliminate wrong answers

Option A is wrong because the HA2 link is used for session synchronization and state propagation, not for keepalive monitoring; a HA2 link failure alone does not trigger a failover unless it also causes HA1 keepalive loss. Option B is wrong because a preemption event would be logged as 'Preempted by local firewall' or 'Preempted by peer firewall', not as a keepalive loss; preemption is a configuration-based event that occurs when the higher-priority firewall comes back online. Option C is wrong because if the peer firewall was rebooted, the failover reason would typically show 'Peer firewall rebooted' or 'HA1 keepalive from the peer was lost' only if the reboot caused keepalive failure, but the direct cause logged is the keepalive loss, not the reboot itself.

Practice this question →
44
MCQmedium

Refer to the exhibit. An engineer configures HA with link monitoring and path monitoring. However, failover does not occur when ethernet1/2 goes down. What is the likely reason?

A.The HA group-id is not unique in the network
B.HA2 link is down preventing failover
C.Path monitoring interval is set too high, causing delayed failover
D.'link-monitoring' is configured under the high-availability hierarchy but not explicitly enabled
AnswerD

In PAN-OS, link monitoring must be enabled with 'enable yes' under high-availability; interfaces alone do not enable it.

Why this answer

In Palo Alto Networks HA configuration, link monitoring is not enabled by default even when the 'link-monitoring' block is present under the 'high-availability' hierarchy. The engineer must explicitly set 'enabled yes' within the 'link-monitoring' configuration to activate it. Without this explicit enable, the firewall will not monitor the specified interfaces for link state changes, so a failure on ethernet1/2 will not trigger a failover.

Exam trap

The trap here is that candidates assume that simply adding the 'link-monitoring' configuration stanza under the HA hierarchy automatically enables link monitoring, when in fact the 'enabled yes' parameter is required to activate it.

How to eliminate wrong answers

Option A is wrong because a non-unique HA group-id would cause both peers to attempt to be active or passive simultaneously, leading to split-brain or failover issues, but it would not prevent failover when a monitored link goes down; the failover would still occur if link monitoring were properly enabled. Option B is wrong because the HA2 link is used for session synchronization and heartbeat, not for link monitoring; if the HA2 link were down, the firewalls would lose heartbeat and potentially both become active, but this would not prevent a link-monitoring-based failover from occurring when ethernet1/2 goes down. Option C is wrong because the path monitoring interval controls how often the firewall checks the reachability of monitored paths (e.g., ping to a next-hop IP), not the link state of an interface; link monitoring reacts immediately to link state changes (up/down) and is not affected by the path monitoring interval.

Practice this question →
45
MCQhard

A large enterprise uses an active/passive HA pair of PA-5250 firewalls to secure their data center. The network team recently migrated from a flat network to a VXLAN-based overlay. After the migration, they notice that during failover tests, the new active firewall does not forward traffic for VXLAN-terminated VLANs, even though the physical interfaces are up and the HA state transitions correctly. The configuration uses subinterfaces on Ethernet1/1 for each VLAN, with VXLAN tunnel termination on the firewall. The passive firewall receives the configuration sync, but show vxlan tunnel shows no VXLAN tunnels on the new active firewall after failover. The sessions are synced via HA2. The ARP table is correct. Which course of action should the engineer take to resolve the issue?

A.Add static routes for the VXLAN tunnel endpoints on the passive firewall.
B.Enable VXLAN tunnel synchronization under HA setup.
C.Reboot the new active firewall to reload the VXLAN configuration.
D.Configure a policy to send a small amount of traffic through each VXLAN tunnel to trigger tunnel establishment on the new active firewall.
AnswerD

This will cause the firewall to re-establish the VXLAN tunnels dynamically.

Why this answer

VXLAN tunnels on Palo Alto Networks firewalls are dynamically established based on data-plane traffic. After a failover, the new active firewall does not automatically rebuild the tunnels; it requires traffic to trigger the tunnel establishment. Sending a small amount of traffic through each VXLAN tunnel forces the firewall to initiate the VXLAN tunnel setup, populating the 'show vxlan tunnel' output and restoring traffic forwarding.

Exam trap

The trap here is that candidates assume configuration sync includes dynamic tunnel state, but Palo Alto Networks firewalls do not synchronize VXLAN tunnel state across HA peers, requiring traffic to trigger tunnel establishment on the new active firewall.

How to eliminate wrong answers

Option A is wrong because static routes for VXLAN tunnel endpoints are not required; the firewall learns the tunnel endpoints via the VXLAN configuration and ARP, and adding static routes does not address the dynamic tunnel establishment issue. Option B is wrong because VXLAN tunnel synchronization is not a configurable feature under HA setup; Palo Alto Networks firewalls do not synchronize VXLAN tunnel state via HA2, only session and configuration sync occur. Option C is wrong because rebooting the firewall would not resolve the issue; the VXLAN configuration is already present from the sync, but the tunnels are not established until data traffic triggers them, and a reboot would cause unnecessary downtime without fixing the root cause.

Practice this question →
46
MCQhard

A large enterprise uses a pair of PA-5250 firewalls in an active/passive high availability configuration to protect their data center. The firewalls are connected to two upstream switches via aggregate Ethernet (AE) interfaces. The network team recently replaced the upstream switches, and since then, the passive firewall has gone into a 'non-functional' state. The active firewall shows no issues. The HA1 link is a direct cable connection between the firewalls, and HA2 is an out-of-band dedicated link. The administrative status of both firewalls is 'active-active' in the HA monitoring, but only one firewall is actually forwarding traffic. The team needs to restore proper HA operation. Which action should the team take first?

A.Verify the physical connectivity and configuration of the HA2 link, as session synchronization failure can cause the passive node to be non-functional.
B.Reboot the passive firewall to attempt to re-establish HA communication.
C.Check the logs on the passive firewall for new critical events during the switch replacement.
D.Review the path monitoring configuration on both firewalls to ensure that the AE link to the new switches is correctly monitored for failover.
AnswerD

Path monitoring checks data plane connectivity; if the monitored interface is down or misconfigured, the passive firewall goes non-functional. The switch replacement likely altered link characteristics, making the monitored path appear failed.

Why this answer

Path monitoring is used in active/passive HA to detect failures of monitored interfaces (like the AE links to the new switches). If the passive firewall's path monitoring configuration does not match the new switch interfaces or if the monitored AE link is down, the passive firewall will enter a 'non-functional' state to prevent it from becoming active with a broken path. The active firewall remains unaffected because it is already forwarding traffic and its path monitoring status is healthy.

Exam trap

The trap here is that candidates often assume the passive firewall's 'non-functional' state is caused by HA link issues (HA1 or HA2) or session synchronization failures, when in fact it is typically due to path monitoring detecting a failed interface on the passive node.

How to eliminate wrong answers

Option A is wrong because the HA2 link is used for session synchronization and state propagation, not for determining the functional state of a passive firewall; a failure of HA2 would cause session sync issues but would not put the passive firewall into a 'non-functional' state. Option B is wrong because rebooting the passive firewall is a brute-force approach that does not address the root cause; if the underlying configuration or connectivity issue persists, the firewall will return to a non-functional state after reboot. Option C is wrong while checking logs is a good troubleshooting step, it is not the first action to take; the most likely cause is a path monitoring misconfiguration related to the new switches, and logs would only confirm the symptom without fixing it.

Practice this question →
47
MCQeasy

A company operates a pair of PA-3220 firewalls in an active/passive HA configuration. The passive firewall is experiencing intermittent HA keepalive failures, causing unnecessary failovers every few minutes. The network engineer checks the HA1 interface statistics and notices packet loss on the dedicated HA1 link. The engineer suspects a physical layer issue. However, the engineer also wants to reduce the sensitivity of the HA keepalive mechanism to tolerate occasional packet loss without triggering a failover. The firewalls are currently using default HA keepalive settings. What should the engineer do to reduce the frequency of false failovers without compromising the ability to detect a true failure?

A.Disable HA1 link monitoring and rely solely on path monitoring.
B.Change the HA mode to active/active to balance traffic and reduce load on the active unit.
C.Enable HA2 and configure it as a second heartbeat link for redundancy.
D.Increase the HA timer (keepalive interval) and increase the number of missed keepalives allowed.
AnswerD

This makes the HA detection less sensitive to sporadic packet loss while still recognizing persistent failure.

Why this answer

Increasing the HA keepalive interval and the number of missed keepalives allowed makes the passive firewall less sensitive to transient packet loss on the HA1 link. This reduces false failovers while still ensuring that a sustained loss of heartbeats (indicating a true failure) will eventually trigger a failover. The default HA keepalive settings use a 1-second interval with 3 missed keepalives allowed; increasing these values provides tolerance for intermittent loss without disabling failure detection.

Exam trap

The trap here is that candidates may think adding a redundant HA2 link (Option C) solves the problem, but it only provides path redundancy and does not change the keepalive timeout sensitivity, so false failovers can still occur if both links suffer packet loss simultaneously.

How to eliminate wrong answers

Option A is wrong because disabling HA1 link monitoring eliminates the dedicated heartbeat path entirely, which would prevent the passive firewall from detecting a true failure of the active unit, compromising high availability. Option B is wrong because changing to active/active mode does not address the keepalive sensitivity issue; it redistributes traffic but still relies on HA1 heartbeats for state synchronization and failure detection, and may introduce other complexities like asymmetric routing. Option C is wrong because adding HA2 as a redundant heartbeat link improves reliability by providing an alternate path for keepalives, but it does not reduce the sensitivity of the keepalive mechanism itself; if both links experience loss, false failovers can still occur.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Managing Troubleshooting Ha questions.

Start 20-question session