Troubleshooting

An administrator notices high CPU usage on the management plane. Which command should be used to identify which process is causing the load?

A network security analyst notices that the dataplane CPU on a Palo Alto Networks firewall is consistently above 90%. They need to identify which network interface is generating the highest volume of traffic to pinpoint the source of the load. Which CLI command should they use?

Which THREE items can be used as filters in the 'test security-policy-match' command?

A NetSec-Analyst is troubleshooting a connectivity issue between two internal subnets. The analyst suspects that the firewall is dropping packets due to a security policy. Which CLI command should the analyst use to view the security policy that is matching a specific flow?

An administrator suspects that a specific App-ID is not correctly identifying traffic. Which log column should they examine to confirm the application match?

Which TWO of the following represent valid interface types on a Palo Alto Networks firewall?

A firewall is reporting 'Packet buffer protection' drops. What is the most likely cause of this issue?

A network security analyst is troubleshooting a connectivity issue where a client cannot access a web server. The analyst runs 'test security-policy-match' and finds that the traffic matches a rule that allows the application 'web-browsing'. However, the analyst notices that the rule has a 'URL Filtering' profile attached that blocks the 'malware' category. The analyst wants to verify whether the URL category of the web server is being correctly identified. Which CLI command should the analyst use to test the URL category for the web server?

A network security analyst notices that a critical business application is intermittently failing. The application traffic passes through a Palo Alto Networks firewall. The analyst wants to identify exactly which security policy rule is allowing or denying the traffic in real time, without committing changes. Which CLI command should the analyst use?

A network security analyst is troubleshooting a performance issue where throughput on a specific sub-interface is lower than expected. The analyst needs to monitor real-time throughput data for that sub-interface to determine if the interface is saturated. Which CLI command should the analyst use?

A security analyst is investigating why a large file transfer from a trusted internal server to an external partner is being blocked. The security policy allows the application 'ftp' and the service 'application-default'. The analyst runs 'show session all filter source 10.1.1.5' and sees the session is in the 'discard' state. Which action should the analyst take next to determine the cause?

A network security analyst is investigating why a specific application is not being identified correctly by App-ID. The analyst wants to see the details of how the firewall classified the application for a particular session. Which CLI command should the analyst use to display the application identification details for an active session?

A network administrator is troubleshooting a connectivity issue between two sites connected by an IPsec VPN. The VPN tunnel status shows as 'up', but no traffic is passing. The administrator wants to verify whether packets are being encrypted and decrypted correctly. Which tool should the administrator use?

A network security administrator is troubleshooting an issue where a user cannot access a website. The administrator checks the traffic log and sees that the session was denied by a security policy. To determine which security policy rule is causing the denial, which CLI command should the administrator use?

A network security administrator notices that a critical business application is intermittently failing to connect through the firewall. The security policy allows the application based on its App-ID. During a failure, the administrator runs a packet capture on the firewall and sees that the first few packets of the session are allowed, but subsequent packets are dropped. Which troubleshooting step should the administrator take first to identify the cause?

An administrator is troubleshooting why a site-to-site VPN tunnel is not passing traffic despite the tunnel showing as 'up'. The administrator suspects that the Phase 2 selectors (proxy IDs) are mismatched. Which TWO commands should the administrator use to verify the proxy IDs on both ends of the tunnel? (Choose two.)

A user reports that they are seeing a 'Server Certificate Warning' when accessing an internal site. Which feature should the administrator investigate?

A security analyst is troubleshooting an issue where a critical application is being blocked intermittently. The analyst suspects that the application is being identified differently at different times. Which TWO actions should the analyst take to verify the application identification and policy matching? (Choose two.)

A network security analyst is troubleshooting connectivity issues between two internal subnets separated by a firewall. The analyst suspects that the firewall is dropping packets due to a security policy rule. Which CLI command should the analyst use to view the real-time packet drop counters for the firewall's dataplane?

An administrator wants to verify that a specific Threat Prevention profile is applied to a security rule. Where is the most accurate place to check this?

When an administrator sees 'incomplete' in the Application column of the traffic logs, what does this usually signify?

A network security analyst is troubleshooting a connectivity problem where internal users cannot reach an external web server. The analyst suspects a NAT issue. After running a packet capture on the firewall, the analyst sees that the source IP address of outbound packets is not being translated to the firewall's external IP address. Which of the following is the most likely cause?

A network security analyst is troubleshooting an issue where a user cannot access a website. The analyst suspects that the traffic is being denied by a security policy. Which CLI command should the analyst use to simulate the flow and see which security policy rule is matching?

Which log would display an event regarding an administrator logging into the WebUI?

A network administrator is troubleshooting why a site-to-site VPN tunnel between two Palo Alto Networks firewalls is not establishing. The administrator runs 'show vpn ike-sa' and sees that the IKE phase 1 negotiation is failing. Which of the following is the most likely cause?

A network security analyst is troubleshooting an issue where a user cannot access an internal web server. The analyst suspects that the firewall is blocking the traffic. Which TWO actions should the analyst take to determine if a security policy rule is causing the block? (Choose two.)

Which TWO log types are stored on the Palo Alto Networks firewall locally?

A network security analyst is troubleshooting why a security policy is not matching traffic as expected. The analyst runs 'test security-policy-match' and sees that the traffic matches a policy, but the action is 'deny'. The analyst wants to see the exact rule that matched. Which field in the output should the analyst examine to identify the matching rule?

Which TWO of the following settings must be verified to ensure successful SSL Decryption?

When troubleshooting a connection, an administrator sees 'aged-out' in the session table. What does this indicate?

A network security analyst is troubleshooting an issue where users on the internal network cannot access a web server hosted in the DMZ. The analyst runs 'show session all filter source 10.1.1.100 destination 192.168.1.50' on the firewall and sees a session in the 'discard' state. Which action should the analyst take next to determine why the session is being discarded?

A network security analyst is troubleshooting an intermittent connectivity issue between a client and a server. The analyst suspects that certain packets are being dropped by the firewall's security policy. The analyst runs 'test security-policy-match' with the relevant parameters on a Palo Alto Networks firewall. Which output field in the CLI result should the analyst examine to identify the specific security policy rule that matched the traffic?

A NetSec-Analyst is troubleshooting why a user cannot access a web application. The traffic is allowed by the security policy, but the application fails to load. The analyst suspects an issue with SSL decryption. Which two actions should the analyst take to verify that SSL decryption is functioning correctly for this traffic? (Choose two.)

A user reports that they cannot access a website, receiving a 'page cannot be displayed' error. Which log type should the administrator check first to see if the traffic is reaching the firewall?

A network security analyst is troubleshooting a site-to-site VPN tunnel that is showing as 'up' but no traffic is passing through it. The analyst wants to verify if the firewall is encrypting and decrypting packets correctly. Which tool should the analyst use to capture and examine the packets?

A network security analyst is troubleshooting why a security policy is not matching traffic from a specific user. The policy is configured to allow HTTP traffic from the 'Trust' zone to the 'Untrust' zone for a specific source IP. The analyst runs 'test security-policy-match' and sees that the traffic matches a different policy that denies it. The analyst wants to determine the exact order of policy evaluation and why the deny policy is matching first. Which action should the analyst take?

A network security analyst is troubleshooting a site-to-site VPN tunnel that shows as 'up' but no traffic is passing. The analyst wants to verify whether the firewall is encrypting and decrypting packets correctly. Which two CLI commands should the analyst use to check the VPN tunnel statistics and the status of the IPsec security associations? (Choose two.)

A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?

A network security analyst is troubleshooting an issue where users on the internal network cannot reach a critical external web application. The security policy rule that should permit this traffic is not generating any logs, and the session count for that rule is zero. The analyst suspects that the traffic is being denied by an implicit rule or is not matching any rule due to a configuration error. Which CLI command should the analyst use to determine the exact rule that is being applied to the traffic?

A network security analyst is investigating intermittent connectivity failures to an external SaaS application. Users report that sometimes the connection works, but other times it times out. The firewall is configured with a security policy that allows the SaaS application by its App-ID, and SSL decryption is enabled for the traffic. The analyst suspects that decryption is failing for some sessions. Which log should the analyst examine first to determine whether decryption is failing and why?

A network security analyst is troubleshooting a site-to-site VPN issue where the tunnel is up, but traffic is not passing. The analyst has verified that the IKE and IPsec security associations are established. The analyst suspects that the issue is related to routing or policy. Which two actions should the analyst perform to further troubleshoot the problem? (Choose two.)

Traffic is failing the 'Service' check in a security policy. Which CLI tool can be used to confirm which application is being identified for a specific source-destination pair?