Troubleshooting practice questions

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

Trap 1: show system resources

This command displays CPU and memory utilization, not packet drops.

Trap 2: show session all

This command displays active sessions, not necessarily real-time dropped packets.

Trap 3: show interface all

This command displays interface status and error counters at the MAC/PHY layer, but not firewall security drop counters.

A
show system resources
Why wrong: This command displays CPU and memory utilization, not packet drops.
B
show session all
Why wrong: This command displays active sessions, not necessarily real-time dropped packets.
C
show counter global filter packet-drop yes
This command correctly filters global counters to display only those related to packet drops.
D
show interface all
Why wrong: This command displays interface status and error counters at the MAC/PHY layer, but not firewall security drop counters.

Question 2hardmultiple choice

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Trap 1: The endpoint's local time is synchronized with an NTP server…

NTP subnet location does not cause TLS failures as long as time sync is accurate.

Trap 2: The agent license key has reached its maximum daily log ingestion…

License limits restrict ingestion volume, they do not cause TLS handshake failures.

Trap 3: The Cortex XDR agent version is newer than the cloud backend tenant…

Palo Alto Networks maintains backward compatibility for agent-to-cloud communication.

A
The endpoint's local time is synchronized with an NTP server outside the local subnet.
Why wrong: NTP subnet location does not cause TLS failures as long as time sync is accurate.
B
The agent license key has reached its maximum daily log ingestion limit.
Why wrong: License limits restrict ingestion volume, they do not cause TLS handshake failures.
C
An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.
SSL interception without proper certificate trust causes TLS handshake termination.
D
The Cortex XDR agent version is newer than the cloud backend tenant version.
Why wrong: Palo Alto Networks maintains backward compatibility for agent-to-cloud communication.

Open the full VLAN trunking answer →

Question 3hardmultiple choice

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

Trap 1: An incorrect Zone Protection Profile flooding threshold

Zone protection thresholds drop packets based on rate-limiting, but do not corrupt Frame Check Sequences (FCS).

Trap 2: A mismatch in Virtual Router metric values

Virtual router metrics affect path selection in routing tables, not Layer 2 Ethernet frame checksums.

Trap 3: Incorrect TCP MSS adjustment on the Layer 3 interface

MSS adjustment modifies TCP payload sizes to prevent fragmentation; it does not cause Layer 2 FCS corruption.

A
An incorrect Zone Protection Profile flooding threshold
Why wrong: Zone protection thresholds drop packets based on rate-limiting, but do not corrupt Frame Check Sequences (FCS).
B
Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference
FCS errors are generated when frames arrive corrupted at the physical layer, pointing to faulty cabling, connectors, or SFPs.
C
A mismatch in Virtual Router metric values
Why wrong: Virtual router metrics affect path selection in routing tables, not Layer 2 Ethernet frame checksums.
D
Incorrect TCP MSS adjustment on the Layer 3 interface
Why wrong: MSS adjustment modifies TCP payload sizes to prevent fragmentation; it does not cause Layer 2 FCS corruption.

Question 4hardmultiple choice

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

Trap 1: The security rule destination zone does not match the source zone.

Inter-zone rules require different source and destination zones by design; this does not cause a zone mismatch packet drop.

Trap 2: The NAT policy is translating the packet to an unassigned IP…

NAT translation errors increment NAT-specific drop counters, not zone mismatch counters.

Trap 3: The Virtual Router has two default routes pointing to different…

Multiple default routes result in ECMP or primary/backup path selection, not zone mismatch drops.

A
The security rule destination zone does not match the source zone.
Why wrong: Inter-zone rules require different source and destination zones by design; this does not cause a zone mismatch packet drop.
B
The NAT policy is translating the packet to an unassigned IP address.
Why wrong: NAT translation errors increment NAT-specific drop counters, not zone mismatch counters.
C
The Virtual Router has two default routes pointing to different interfaces.
Why wrong: Multiple default routes result in ECMP or primary/backup path selection, not zone mismatch drops.
D
The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.
A zone mismatch drop occurs when traffic hits an interface whose zone association contradicts the forwarding path or session table lookup.

Open the full BGP breakdown →

Question 5hardmultiple choice

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Trap 1: The firewall's management plane CPU is exceeding 90% utilization.

Routing protocols run on the data plane or routing daemon; management CPU spikes do not selectively invalidate BGP route selection attributes.

Trap 2: The BGP peer is configured in a different autonomous system.

EBGP peers are in different AS numbers by definition; this does not prevent route installation.

Trap 3: The Virtual Router does not have OSPF enabled.

OSPF is an independent interior gateway protocol and is not required for BGP route installation.

A
The firewall's management plane CPU is exceeding 90% utilization.
Why wrong: Routing protocols run on the data plane or routing daemon; management CPU spikes do not selectively invalidate BGP route selection attributes.
B
The next-hop IP address advertised by the BGP peer is unreachable in the routing table.
If the next-hop IP address cannot be resolved in the routing table (recursive lookup failure), BGP marks the route as invalid or not best.
C
The BGP peer is configured in a different autonomous system.
Why wrong: EBGP peers are in different AS numbers by definition; this does not prevent route installation.
D
The Virtual Router does not have OSPF enabled.
Why wrong: OSPF is an independent interior gateway protocol and is not required for BGP route installation.

Question 6hardmultiple choice

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Trap 1: show running-config security-rules

This outputs the XML/text configuration of security rules without live evaluation.

Trap 2: debug dataplane packet-log dump

This is a packet capture debugging syntax, not a policy evaluation command.

Trap 3: show system resources active-sessions

This command displays CPU/memory or active session counts, not policy rule evaluation.

A
show running-config security-rules
Why wrong: This outputs the XML/text configuration of security rules without live evaluation.
B
test security-policy-matching source [IP] destination [IP] application [app]
This command evaluates policy rules against specific parameters to determine the matching rule.
C
debug dataplane packet-log dump
Why wrong: This is a packet capture debugging syntax, not a policy evaluation command.
D
show system resources active-sessions
Why wrong: This command displays CPU/memory or active session counts, not policy rule evaluation.

Question 7hardmulti select

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

Trap 1: Check that local DHCP leases are renewed every 30 seconds.

DHCP lease duration does not impact cloud reporting connectivity.

Trap 2: Confirm that inbound SSH port 22 is open on all endpoint host…

SSH is not required for Cortex XDR agent reporting.

Trap 3: Verify that SNMP v3 trap listeners are active on port 162.

SNMP is not used for Cortex XDR cloud communication.

A
Check that local DHCP leases are renewed every 30 seconds.
Why wrong: DHCP lease duration does not impact cloud reporting connectivity.
B
Ensure outbound TCP port 443 traffic is permitted to the Cortex XDR backend FQDNs.
Outbound HTTPS is required for agent-to-cloud telemetry reporting.
C
Verify that local DNS servers can successfully resolve the Cortex XDR tenant service endpoints.
DNS resolution is required to connect to backend cloud services.
D
Confirm that inbound SSH port 22 is open on all endpoint host firewalls.
Why wrong: SSH is not required for Cortex XDR agent reporting.
E
Verify that SNMP v3 trap listeners are active on port 162.
Why wrong: SNMP is not used for Cortex XDR cloud communication.

Review the full routing breakdown →

Question 8hardmulti select

An administrator is troubleshooting a complex routing issue where traffic is not taking the expected static route. Which TWO commands can the administrator use to inspect the routing table and test route lookup for a specific destination IP address? (Choose two)

Trap 1: debug routing table dump

This is not the standard operational command for checking route lookups.

Trap 2: show ip route summary

This is a Cisco IOS command syntax, not a valid PAN-OS command.

Trap 3: show network interface routes

This command does not exist in PAN-OS.

A
test routing fib_lookup ip [IP Address]
This operational command simulates a Forwarding Information Base (FIB) lookup for a specific destination IP address.
B
debug routing table dump
Why wrong: This is not the standard operational command for checking route lookups.
C
show routing route
This command displays the contents of the virtual router routing table.
D
show ip route summary
Why wrong: This is a Cisco IOS command syntax, not a valid PAN-OS command.
E
show network interface routes
Why wrong: This command does not exist in PAN-OS.

Question 9hardmulti select

An administrator is troubleshooting packet drops on a Palo Alto Networks firewall and wants to inspect dropped packets or hardware counters using CLI diagnostic tools. Which TWO commands can be used to review packet drop information? (Choose two)

Trap 1: debug session drop-history

Session drop history is retrieved via packet capture and session dump utilities, not this specific syntax.

Trap 2: show ip route drop-packets

This command does not exist in PAN-OS CLI.

Trap 3: show interface drop-counters all

This is not a valid PAN-OS command syntax.

A
debug session drop-history
Why wrong: Session drop history is retrieved via packet capture and session dump utilities, not this specific syntax.
B
show counter global filter packet-drop yes
This command filters global counters to display active packet drops.
C
show ip route drop-packets
Why wrong: This command does not exist in PAN-OS CLI.
D
show interface drop-counters all
Why wrong: This is not a valid PAN-OS command syntax.
E
show counter global filter delta yes
This command displays changes in global counters over time, which is helpful for troubleshooting intermittent drops.

Review the full routing breakdown →

Question 10hardmulti select

An administrator is troubleshooting asymmetric routing issues where packets arrive out of order or fail stateful checks. Which TWO features or settings in PAN-OS can assist in handling or mitigating asymmetric routing challenges? (Choose two)

Trap 1: Configuring a secondary DHCP scope

DHCP configuration is unrelated to routing packet asymmetry.

Trap 2: Enabling Strict RPF (Reverse Path Forwarding)

Strict RPF drops packets if the return path does not match the incoming interface, which worsens asymmetric routing problems.

Trap 3: Enforcing BGP Route Reflection

Route reflection solves IBGP full-mesh scaling, not packet-level asymmetric routing path issues.

A
Configuring a secondary DHCP scope
Why wrong: DHCP configuration is unrelated to routing packet asymmetry.
B
Disabling strict TCP handshake validation
Disabling strict TCP validation helps prevent the firewall from dropping packets that arrive out of normal sequence due to routing asymmetries.
C
Enabling Strict RPF (Reverse Path Forwarding)
Why wrong: Strict RPF drops packets if the return path does not match the incoming interface, which worsens asymmetric routing problems.
D
Enforcing BGP Route Reflection
Why wrong: Route reflection solves IBGP full-mesh scaling, not packet-level asymmetric routing path issues.
E
Asymmetric Path Bypass
Enabling asymmetric path bypass allows the firewall to accept sessions where the return path is different.

Read the full NAT/PAT explanation →

Question 11hardmultiple choice

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

Trap 1: Missing User-ID mapping for the internal client IP addresses.

User-ID maps users to IPs, but DNAT/SNAT routing handles server reachability.

Trap 2: Incorrect configuration of the GlobalProtect Portal external…

GlobalProtect settings do not impact internal web server routing.

Trap 3: Attaching an incorrect WildFire analysis profile to the security…

WildFire profiles deal with malware analysis, not IP routing or NAT.

A
Failure to configure NAT Loopback (or hairpin NAT) when internal clients access public IPs of internal servers.
NAT Loopback is required when internal clients access internal servers via their external public NAT IP.
B
Missing User-ID mapping for the internal client IP addresses.
Why wrong: User-ID maps users to IPs, but DNAT/SNAT routing handles server reachability.
C
Incorrect configuration of the GlobalProtect Portal external gateway address.
Why wrong: GlobalProtect settings do not impact internal web server routing.
D
Attaching an incorrect WildFire analysis profile to the security rule.
Why wrong: WildFire profiles deal with malware analysis, not IP routing or NAT.

Read the full network assurance explanation →

Question 12hardmultiple choice

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

Trap 1: Open the msiexec.log file generated during the initial software…

msiexec.log tracks installation progress, not ongoing agent telemetry communication status.

Trap 2: Check the /var/log/pan/nsm.log file on the log collector.

nsm.log is a Panorama/Log Collector file, not an endpoint log.

Trap 3: Inspect the pan_event_log.csv file in the PAN-OS system partition.

pan_event_log.csv is a PAN-OS firewall log structure, not an endpoint agent log.

A
Open the msiexec.log file generated during the initial software installation.
Why wrong: msiexec.log tracks installation progress, not ongoing agent telemetry communication status.
B
Review the Cyvera.txt log file located in the Cortex XDR installation directory.
Cyvera.txt logs agent operations, communication errors, and module statuses on Windows endpoints.
C
Check the /var/log/pan/nsm.log file on the log collector.
Why wrong: nsm.log is a Panorama/Log Collector file, not an endpoint log.
D
Inspect the pan_event_log.csv file in the PAN-OS system partition.
Why wrong: pan_event_log.csv is a PAN-OS firewall log structure, not an endpoint agent log.