PCNSE Manage, Monitor and Operate Practice Question

Exhibit

Refer to the exhibit.

admin@PA-5250> show session all

Total sessions shown: 1

Session 1:
  Source IP: 10.0.0.100
  Destination IP: 203.0.113.50
  Source port: 49152
  Destination port: 443
  Protocol: TCP
  State: SYN_SENT
  Application: incomplete
  Bytes: 0

What does the session state 'SYN_SENT' indicate about this traffic flow?

⚠ Common exam trap

Many candidates confuse SYN_SENT with a session teardown state or assume it indicates a problem like asymmetric routing, when in fact it is a normal transient state during TCP connection setup that only becomes problematic if it persists beyond the timeout.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The firewall has sent a SYN packet and is waiting for a response.

The SYN_SENT session state in a Palo Alto Networks firewall indicates that the firewall has sent a SYN packet to initiate a TCP three-way handshake and is awaiting a SYN-ACK response from the remote host. This state is part of the firewall's session setup process, where it tracks the TCP connection state machine to ensure proper traffic flow. It does not imply a teardown, asymmetric routing drop, or incomplete application identification.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The session has been torn down by the server.
Why it's wrong here
A torn-down session would show CLOSE or CLOSE_WAIT.
✓
The firewall has sent a SYN packet and is waiting for a response.
Why this is correct
SYN_SENT indicates the firewall is in the process of opening a connection.
✗
The traffic is being dropped due to asymmetric routing.
Why it's wrong here
Asymmetric routing often shows SYN_SENT or SYN_RECV but not exclusively.
✗
The application has been identified as incomplete.
Why it's wrong here
Application detection happens after the session is established.

Visual reference

Quick reference

Asymmetric Encryption Algorithm Comparison

Algorithm	Key Exchange	Signatures	Equivalent Security Key	Notes
RSA-3072	Yes	Yes	128-bit	Widely deployed; slow for bulk data
ECDSA P-256	No	Yes	128-bit	Fast signatures; standard TLS certs
ECDH / ECDHE	Yes	No	128-bit	Perfect forward secrecy in TLS 1.3
DH / DHE	Yes	No	128-bit (3072-bit key)	Replaced by ECDHE in modern TLS
Ed25519	No	Yes	~128-bit	SSH keys, modern PKI

Go deeper

PCNSE Manage, Monitor and Operate Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Asymmetric Encryption Algorithm Comparison

Related to this question