PCNSE Deploy and Configure Firewalls Practice Question
Which THREE are valid methods to provide redundancy for outbound internet traffic in a Palo Alto Networks firewall?
⚠ Common exam trap
Watch out — candidates often confuse virtual router synchronization (which only replicates routing tables) with actual failover mechanisms like floating IPs or path monitoring, assuming that synchronized routing alone provides redundancy for outbound traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active/Passive HA with floating IP
Active/Passive HA with floating IP (Option A) is valid because the passive firewall assumes the active firewall's IP address upon failover, ensuring outbound traffic continues via the same default gateway. ECMP with equal cost routes (Option B) distributes outbound traffic across multiple paths and provides redundancy by automatically failing over if one path is lost. Policy Based Forwarding combined with path monitoring (Option C) allows you to define forwarding policies based on traffic attributes and monitor path health, redirecting traffic if a monitored path fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Active/Passive HA with floating IP
Why this is correct
HA provides failover; the floating IP moves to the active firewall.
- ✓
ECMP with equal cost routes
Why this is correct
ECMP provides load balancing and automatic failover if a route becomes unavailable.
- ✓
Policy Based Forwarding combined with path monitoring
Why this is correct
PBF with path monitoring can switch to a backup path if the primary fails.
- ✗
Active/Passive HA with virtual router synchronization
Why it's wrong here
VR synchronization is a mechanism within HA, not a separate redundancy method.
- ✗
Use of multiple public IPs with NAT rules
Why it's wrong here
Multiple IPs alone do not provide redundancy; routing must also be configured.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.