PCNSE Troubleshoot Practice Question
Which THREE factors can cause a session to be terminated abnormally with a 'tcp-rst-from-server' or 'tcp-rst-from-client' flag in the session end reason? (Choose three.)
⚠ Common exam trap
A common mix-up: candidates confuse session termination reasons, assuming any abnormal end is due to resource exhaustion or timeouts, but the question specifically targets TCP RST flags, which are tied to endpoint behavior, not firewall resource management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server sends a TCP RST packet to the client.
A TCP RST packet from the server indicates that the server has abruptly terminated the connection, often due to an application-layer error or a protocol violation. The firewall logs this as 'tcp-rst-from-server' in the session end reason, reflecting that the reset originated from the server side.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The server sends a TCP RST packet to the client.
Why this is correct
The firewall records the RST as the session end reason.
- ✓
The firewall's application override is incorrectly matching the traffic.
Why this is correct
An incorrect application override can cause the firewall to apply wrong policy or decoding, leading to resets.
- ✗
The session reaches the configured idle timeout.
Why it's wrong here
Idle timeout results in a 'aged-out' end reason, not a RST.
- ✓
A decryption error occurs during SSL handshake.
Why this is correct
If decryption fails, the firewall may send a TCP RST to both sides.
- ✗
The firewall runs out of session resources and starts dropping new sessions.
Why it's wrong here
Resource exhaustion typically causes new sessions to be dropped, not existing sessions to be reset.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.