PCNSE Core Concepts and Architecture Practice Question
Which TWO of the following are valid methods to collect logs from a Palo Alto Networks firewall for reporting and forensics?
⚠ Common exam trap
Many exam-takers confuse 'log collection' with 'alerting mechanisms' (SNMP traps and email alerts), assuming they can replace full log export, but Palo Alto firewalls require dedicated log forwarding methods (syslog, Panorama, or local export) for complete reporting and forensics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Local storage on the firewall's management disk (MP) and export via the web interface.
The firewall's management plane (MP) includes a local log storage partition that can hold logs (e.g., traffic, threat, system) and allows export via the web interface (Monitor > Logs > Export). This provides a built-in method for log collection without requiring external infrastructure. Option E is correct because syslog (UDP/TCP, RFC 3164 or RFC 5424) is a standard protocol supported by Palo Alto firewalls to forward all log types to an external collector for centralized reporting and forensics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Export to Microsoft Azure Sentinel directly without any intermediate.
Why it's wrong here
Direct export to Azure Sentinel requires additional configuration or a connector.
- ✓
Local storage on the firewall's management disk (MP) and export via the web interface.
Why this is correct
Logs are stored locally and can be exported.
- ✗
SNMPv3 traps for all log types.
Why it's wrong here
SNMP is for monitoring health, not detailed logging.
- ✗
Email alerts for all threat logs.
Why it's wrong here
Email can be used for alarms but not for bulk logging.
- ✓
Syslog to an external log collector.
Why this is correct
Syslog is a standard method for forwarding logs.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.