24 questions · Troubleshooting · All types, answers revealed
An administrator notices high CPU usage on the management plane. Which command should be used to identify which process is causing the load?
This command displays process-specific resource utilization.
Why this answer
The 'show system resources' command provides a real-time view of CPU and memory utilization per process.
Which THREE items can be used as filters in the 'test security-policy-match' command?
Standard filter.
Why this answer
The test tool requires source, destination, and application/service parameters to accurately simulate the match.
Which TWO of the following actions in a security policy will result in an entry in the Threat Log?
Triggers threat log.
Why this answer
The 'alert' and 'drop' actions in security profiles (within a policy) trigger threat logs.
An administrator suspects that a specific App-ID is not correctly identifying traffic. Which log column should they examine to confirm the application match?
This column displays the identified application.
Why this answer
The 'Application' column in the Traffic log explicitly displays what the firewall identified as the application for the session.
Which TWO of the following represent valid interface types on a Palo Alto Networks firewall?
Standard routed interface.
Why this answer
Layer 3 and Layer 2 are the most common interface types used for traffic handling.
Which THREE of the following are components of the dataplane in the Palo Alto Networks architecture?
Core dataplane function.
Why this answer
The dataplane consists of the security processing, session management, and hardware acceleration components.
A firewall is reporting 'Packet buffer protection' drops. What is the most likely cause of this issue?
Buffer protection is designed to prevent exhaustion during traffic bursts.
Why this answer
Packet buffer protection is triggered when the firewall receives traffic faster than it can process, often due to a DoS attack or massive traffic spike.
A administrator is troubleshooting an intermittent application failure. The Traffic log shows the session is aging out due to 'tcp-rst-from-client'. What is the most effective way to determine if the Palo Alto Networks firewall is prematurely closing the session?
This command identifies real-time drops happening within the dataplane.
Why this answer
Running a debug flow filter and then observing the output via 'show counter global' helps identify if the firewall is dropping the packet due to internal resource exhaustion or state mismatches.
If an administrator needs to check the status of a physical interface to see if it is 'up/up', which CLI command is most appropriate?
This command displays detailed status for all configured interfaces.
Why this answer
The 'show interface' command provides the link state and operational status of physical interfaces.
An administrator has configured a new NAT rule, but traffic is not traversing it. Which column in the NAT logs is the most useful for verifying the NAT translation is occurring?
This shows the result of the NAT rule application.
Why this answer
The NAT logs show the 'Source Translated' and 'Destination Translated' addresses, confirming if the rule was applied.
Which TWO of the following logs are most useful when troubleshooting a potential Denial of Service (DoS) attack?
Captures system resource alerts.
Why this answer
Threat logs show the specific DoS event triggering, and System logs provide the overall context and resource alerts.
A user reports that they are seeing a 'Server Certificate Warning' when accessing an internal site. Which feature should the administrator investigate?
The decryption policy controls how the firewall re-signs traffic; incorrect CA trust causes these warnings.
Why this answer
SSL Forward Proxy decryption issues usually manifest as certificate warnings if the users do not trust the CA that signed the re-signed certificate.
If you are unable to ping a management interface from a remote subnet, what is the first setting you should check?
This defines which protocols are permitted on the management interface.
Why this answer
The 'Management Interface Settings' control which services (like Ping/HTTPS) are allowed on the management port.
An administrator wants to verify that a specific Threat Prevention profile is applied to a security rule. Where is the most accurate place to check this?
This is where profile assignment is configured for the rule.
Why this answer
Within the Security Policy rule definitions, each rule has a dedicated 'Actions' tab where the Profile Group or specific profile is mapped.
When an administrator sees 'incomplete' in the Application column of the traffic logs, what does this usually signify?
This is the standard definition of 'incomplete' sessions.
Why this answer
Incomplete means the firewall did not see enough packets to successfully identify the application (e.g., the session closed too early).
Which THREE CLI commands help in diagnosing routing issues?
Verifies neighbor connectivity.
Why this answer
These commands show the routing table, specific route resolution, and ARP table/neighbor status.
Which log would display an event regarding an administrator logging into the WebUI?
System logs record events like logins, config changes, and system errors.
Why this answer
Configuration and administrative access logs are stored in the System log.
A DHCP server configured on the firewall is not assigning IPs to clients. Which tool is best to troubleshoot the DHCP relay/server process?
This is the dedicated debugging tool for DHCP-related issues on the firewall.
Why this answer
The 'debug dhcp' commands allow the administrator to see the DHCP request/offer process in the logs.
Which TWO log types are stored on the Palo Alto Networks firewall locally?
Local storage.
Why this answer
Traffic and Threat logs are the most common logs stored locally by default.
Which TWO of the following settings must be verified to ensure successful SSL Decryption?
Required to trigger decryption.
Why this answer
Successful decryption requires both a valid CA certificate and the appropriate SSL decryption policy enabled.
Which CLI command is used to verify the current status of the high availability (HA) pair?
Provides the HA mode, state, and peer info.
Why this answer
The 'show high-availability state' command provides the current operational status and role of each firewall in the HA pair.
When troubleshooting a connection, an administrator sees 'aged-out' in the session table. What does this indicate?
Aged-out indicates the inactivity timer expired.
Why this answer
Aged-out means the session was closed by the firewall because no traffic was seen for that session for a duration exceeding the timeout value.
A user reports that they cannot access a website, receiving a 'page cannot be displayed' error. Which log type should the administrator check first to see if the traffic is reaching the firewall?
The Traffic log is the first stop to verify if the firewall is receiving and processing the traffic.
Why this answer
The Traffic log tracks every session that hits the firewall, making it the primary source for connectivity troubleshooting.
Traffic is failing the 'Service' check in a security policy. Which CLI tool can be used to confirm which application is being identified for a specific source-destination pair?
This utility simulates traffic to see which security policy rule would match.
Why this answer
The 'test security-policy-match' tool simulates a policy lookup to determine which rule and application-ID will be matched for a given flow.
Ready to test yourself?
Try a timed practice session using only Troubleshooting questions.