PCNSE Troubleshoot Practice Question
Which TWO are common causes of session drops after the initial handshake? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse session drops caused by policy changes (Option C) with stateful inspection issues, but Palo Alto firewalls do not retroactively apply policy changes to existing sessions unless explicitly configured to do so.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP sequence number mismatch due to packet reordering
TCP sequence number mismatches can occur when packets are reordered, causing the firewall's TCP state engine to see an unexpected sequence number and drop the session. The firewall tracks TCP sequence numbers to validate that packets belong to an established session; if a packet arrives with a sequence number that does not match the expected window, the firewall may interpret it as a spoofed or invalid packet and terminate the session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TCP sequence number mismatch due to packet reordering
Why this is correct
Reordering can cause the firewall to drop packets as out-of-state.
- ✗
Firewall interface speed mismatch
Why it's wrong here
Speed mismatch would cause physical layer issues, not session drops.
- ✗
Security policy change after session creation
Why it's wrong here
Policy changes apply to new sessions, not existing ones.
- ✗
DNS resolution failure
Why it's wrong here
DNS failure occurs before session creation.
- ✓
Asymmetric routing
Why this is correct
Return traffic taking different path causes session lookup failure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.