How many Troubleshooting Scenario Questions questions are on this page?

This page has 14 Troubleshooting Scenario Questions scenario questions for the Cybersecurity-Apprentice exam, each with detailed explanations and wrong-answer analysis.

How should I approach Cybersecurity-Apprentice scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

Cybersecurity-Apprentice

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related Cybersecurity-Apprentice topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Endpoint Security practice questions

Practise Cybersecurity-Apprentice questions linked to Endpoint Security.

Cloud Security practice questions

Targeted Cybersecurity-Apprentice practice covering Cloud Security.

Network Fundamentals practice questions

Work through Cybersecurity-Apprentice questions on Network Fundamentals.

Network Security practice questions

Sharpen your Cybersecurity-Apprentice knowledge of Network Security.

Security Operations practice questions

Sharpen your Cybersecurity-Apprentice knowledge of Security Operations.

Cybersecurity Fundamentals practice questions

Sharpen your Cybersecurity-Apprentice knowledge of Cybersecurity Fundamentals.

Cybersecurity-Apprentice fundamentals practice questions

Targeted Cybersecurity-Apprentice practice covering Cybersecurity-Apprentice fundamentals.

Cybersecurity-Apprentice scenario practice questions

Sharpen your Cybersecurity-Apprentice knowledge of Cybersecurity-Apprentice scenario.

Cybersecurity-Apprentice troubleshooting practice questions

Cybersecurity-Apprentice troubleshooting practice questions for Cybersecurity-Apprentice.

Practice set

Practice scenarios

Question 1easymultiple choice

Full question →

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

A
show system resources
Why wrong: This command displays CPU and memory utilization, not packet drops.
B
show session all
Why wrong: This command displays active sessions, not necessarily real-time dropped packets.
C
show counter global filter packet-drop yes
This command correctly filters global counters to display only those related to packet drops.
D
show interface all
Why wrong: This command displays interface status and error counters at the MAC/PHY layer, but not firewall security drop counters.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

A
The endpoint's local time is synchronized with an NTP server outside the local subnet.
Why wrong: NTP subnet location does not cause TLS failures as long as time sync is accurate.
B
The agent license key has reached its maximum daily log ingestion limit.
Why wrong: License limits restrict ingestion volume, they do not cause TLS handshake failures.
C
An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.
SSL interception without proper certificate trust causes TLS handshake termination.
D
The Cortex XDR agent version is newer than the cloud backend tenant version.
Why wrong: Palo Alto Networks maintains backward compatibility for agent-to-cloud communication.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full VPN explanation →

An administrator is setting up a Site-to-Site IPsec VPN tunnel on a Palo Alto Networks firewall. The VPN tunnel comes up, but traffic from the local subnet cannot reach the remote subnet. Upon checking the IPsec SA status, the phase 2 security associations are active. What is the most likely cause of the traffic failure?

A
A mismatch in Proxy IDs between the local and remote peers
If Proxy IDs (subnet selectors) do not match on both ends of an IKEv1 IPsec tunnel, traffic matching the local policy will be dropped by the crypto engine.
B
Lifetime expiration in Phase 1 negotiation
Why wrong: Phase 1 lifetime mismatches prevent initial IKE SA establishment.
C
DHCP relay configuration on the tunnel interface
Why wrong: Tunnel interfaces do not typically use DHCP relay for site-to-site VPN traffic forwarding.
D
Phase 1 Encryption algorithm mismatch (e.g., AES-256 vs AES-128)
Why wrong: If Phase 1 encryption algorithms mismatch, the tunnel will fail to come up entirely.

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

A
An incorrect Zone Protection Profile flooding threshold
Why wrong: Zone protection thresholds drop packets based on rate-limiting, but do not corrupt Frame Check Sequences (FCS).
B
Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference
FCS errors are generated when frames arrive corrupted at the physical layer, pointing to faulty cabling, connectors, or SFPs.
C
A mismatch in Virtual Router metric values
Why wrong: Virtual router metrics affect path selection in routing tables, not Layer 2 Ethernet frame checksums.
D
Incorrect TCP MSS adjustment on the Layer 3 interface
Why wrong: MSS adjustment modifies TCP payload sizes to prevent fragmentation; it does not cause Layer 2 FCS corruption.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

A
The security rule destination zone does not match the source zone.
Why wrong: Inter-zone rules require different source and destination zones by design; this does not cause a zone mismatch packet drop.
B
The NAT policy is translating the packet to an unassigned IP address.
Why wrong: NAT translation errors increment NAT-specific drop counters, not zone mismatch counters.
C
The Virtual Router has two default routes pointing to different interfaces.
Why wrong: Multiple default routes result in ECMP or primary/backup path selection, not zone mismatch drops.
D
The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.
A zone mismatch drop occurs when traffic hits an interface whose zone association contradicts the forwarding path or session table lookup.

Full breakdown with real-world context →

Question 6hardmultiple choice

Open the full BGP breakdown →

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

A
The firewall's management plane CPU is exceeding 90% utilization.
Why wrong: Routing protocols run on the data plane or routing daemon; management CPU spikes do not selectively invalidate BGP route selection attributes.
B
The next-hop IP address advertised by the BGP peer is unreachable in the routing table.
If the next-hop IP address cannot be resolved in the routing table (recursive lookup failure), BGP marks the route as invalid or not best.
C
The BGP peer is configured in a different autonomous system.
Why wrong: EBGP peers are in different AS numbers by definition; this does not prevent route installation.
D
The Virtual Router does not have OSPF enabled.
Why wrong: OSPF is an independent interior gateway protocol and is not required for BGP route installation.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

A
show running-config security-rules
Why wrong: This outputs the XML/text configuration of security rules without live evaluation.
B
test security-policy-matching source [IP] destination [IP] application [app]
This command evaluates policy rules against specific parameters to determine the matching rule.
C
debug dataplane packet-log dump
Why wrong: This is a packet capture debugging syntax, not a policy evaluation command.
D
show system resources active-sessions
Why wrong: This command displays CPU/memory or active session counts, not policy rule evaluation.

Full breakdown with real-world context →

Question 8hardmulti select

Full question →

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

A
Check that local DHCP leases are renewed every 30 seconds.
Why wrong: DHCP lease duration does not impact cloud reporting connectivity.
B
Ensure outbound TCP port 443 traffic is permitted to the Cortex XDR backend FQDNs.
Outbound HTTPS is required for agent-to-cloud telemetry reporting.
C
Verify that local DNS servers can successfully resolve the Cortex XDR tenant service endpoints.
DNS resolution is required to connect to backend cloud services.
D
Confirm that inbound SSH port 22 is open on all endpoint host firewalls.
Why wrong: SSH is not required for Cortex XDR agent reporting.
E
Verify that SNMP v3 trap listeners are active on port 162.
Why wrong: SNMP is not used for Cortex XDR cloud communication.

Full breakdown with real-world context →

Question 9hardmulti select

Review the full routing breakdown →

An administrator is troubleshooting a complex routing issue where traffic is not taking the expected static route. Which TWO commands can the administrator use to inspect the routing table and test route lookup for a specific destination IP address? (Choose two)

A
test routing fib_lookup ip [IP Address]
This operational command simulates a Forwarding Information Base (FIB) lookup for a specific destination IP address.
B
debug routing table dump
Why wrong: This is not the standard operational command for checking route lookups.
C
show routing route
This command displays the contents of the virtual router routing table.
D
show ip route summary
Why wrong: This is a Cisco IOS command syntax, not a valid PAN-OS command.
E
show network interface routes
Why wrong: This command does not exist in PAN-OS.

Full breakdown with real-world context →

Question 10hardmulti select

Full question →

An administrator is troubleshooting packet drops on a Palo Alto Networks firewall and wants to inspect dropped packets or hardware counters using CLI diagnostic tools. Which TWO commands can be used to review packet drop information? (Choose two)

A
debug session drop-history
Why wrong: Session drop history is retrieved via packet capture and session dump utilities, not this specific syntax.
B
show counter global filter packet-drop yes
This command filters global counters to display active packet drops.
C
show ip route drop-packets
Why wrong: This command does not exist in PAN-OS CLI.
D
show interface drop-counters all
Why wrong: This is not a valid PAN-OS command syntax.
E
show counter global filter delta yes
This command displays changes in global counters over time, which is helpful for troubleshooting intermittent drops.

Full breakdown with real-world context →

Question 11hardmulti select

Review the full routing breakdown →

An administrator is troubleshooting asymmetric routing issues where packets arrive out of order or fail stateful checks. Which TWO features or settings in PAN-OS can assist in handling or mitigating asymmetric routing challenges? (Choose two)

A
Configuring a secondary DHCP scope
Why wrong: DHCP configuration is unrelated to routing packet asymmetry.
B
Disabling strict TCP handshake validation
Disabling strict TCP validation helps prevent the firewall from dropping packets that arrive out of normal sequence due to routing asymmetries.
C
Enabling Strict RPF (Reverse Path Forwarding)
Why wrong: Strict RPF drops packets if the return path does not match the incoming interface, which worsens asymmetric routing problems.
D
Enforcing BGP Route Reflection
Why wrong: Route reflection solves IBGP full-mesh scaling, not packet-level asymmetric routing path issues.
E
Asymmetric Path Bypass
Enabling asymmetric path bypass allows the firewall to accept sessions where the return path is different.

Full breakdown with real-world context →

Question 12hardmulti select

Full question →

An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)

A
CLI command: show high-availability state
Why wrong: This command checks HA operational status, not user mappings.
B
CLI command: show interface hardware
Why wrong: This command shows physical interface counters and MAC addresses.
C
CLI command: show user ip-user-mapping all
This command displays active IP-to-username mappings currently recognized by the firewall.
D
CLI command: show system environmental
Why wrong: This command displays hardware temperatures, fan speeds, and power supply status.
E
CLI command: show user group name <group-name>
This command verifies group memberships associated with User-ID.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full NAT/PAT explanation →

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

A
Failure to configure NAT Loopback (or hairpin NAT) when internal clients access public IPs of internal servers.
NAT Loopback is required when internal clients access internal servers via their external public NAT IP.
B
Missing User-ID mapping for the internal client IP addresses.
Why wrong: User-ID maps users to IPs, but DNAT/SNAT routing handles server reachability.
C
Incorrect configuration of the GlobalProtect Portal external gateway address.
Why wrong: GlobalProtect settings do not impact internal web server routing.
D
Attaching an incorrect WildFire analysis profile to the security rule.
Why wrong: WildFire profiles deal with malware analysis, not IP routing or NAT.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full network assurance explanation →

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

A
Open the msiexec.log file generated during the initial software installation.
Why wrong: msiexec.log tracks installation progress, not ongoing agent telemetry communication status.
B
Review the Cyvera.txt log file located in the Cortex XDR installation directory.
Cyvera.txt logs agent operations, communication errors, and module statuses on Windows endpoints.
C
Check the /var/log/pan/nsm.log file on the log collector.
Why wrong: nsm.log is a Panorama/Log Collector file, not an endpoint log.
D
Inspect the pan_event_log.csv file in the PAN-OS system partition.
Why wrong: pan_event_log.csv is a PAN-OS firewall log structure, not an endpoint agent log.

Full breakdown with real-world context →

These Cybersecurity-Apprentice practice questions are part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style Cybersecurity-Apprentice questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.