PCNSE Core Concepts and Architecture Practice Question
Which two are prerequisites for deploying a Palo Alto Networks firewall in a high-availability active/passive pair? (Choose two.)
⚠ Common exam trap
Test-takers frequently assume a direct crossover cable is required for HA1, but Palo Alto Networks supports HA1 over any routable Layer 3 interface, including through switches, making option E a common distractor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both firewalls must be the same hardware model.
Palo Alto Networks high-availability (HA) active/passive pairs require both firewalls to be the same hardware model to ensure identical processing capabilities and interface configurations. Option D is correct because both firewalls must run the same PAN-OS version to maintain configuration synchronization and stateful failover compatibility; version mismatches can cause HA session sync failures or unexpected behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Both firewalls must have identical licenses.
Why it's wrong here
License mismatch does not prevent HA, though some features may not sync.
- ✓
Both firewalls must be the same hardware model.
Why this is correct
Same model ensures compatibility for HA.
- ✗
Both firewalls must be in the same data center.
Why it's wrong here
Firewalls can be in different locations if HA links are routed.
- ✓
Both firewalls must have the same PAN-OS version.
Why this is correct
Same software version is required for synchronization.
- ✗
The firewalls must be directly connected via a crossover cable for HA1.
Why it's wrong here
The HA1 link can be through a switch; direct connection is not required.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.