NetSec-Architect Practice Question: Centralized Management And Security Automation AT Scale
An architect is designing a high-availability Panorama deployment across two data centers. During a WAN partition event, both Panorama nodes lose connectivity with each other but retain management access to local firewalls. What happens to the management plane operations of the managed firewalls in this split-brain scenario?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed firewalls continue to process traffic normally using their cached running configuration, but cannot receive policy updates until connectivity is restored.
Managed firewalls operate independently using their last known running configuration. They do not depend on active Panorama connectivity for packet forwarding or local policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Both Panorama nodes automatically initiate a factory reset of all managed firewalls to prevent configuration drift.
Why it's wrong here
Panorama never initiates a factory reset due to a network partition.
- ✓
Managed firewalls continue to process traffic normally using their cached running configuration, but cannot receive policy updates until connectivity is restored.
Why this is correct
Firewalls are autonomous data-plane devices; loss of Panorama management results in loss of centralized pushes, but local traffic forwarding is unaffected.
- ✗
Managed firewalls immediately enter a fail-safe suspended state and drop all transit traffic.
Why it's wrong here
Firewalls do not drop traffic upon losing management connectivity to Panorama; they maintain independent data plane operation.
- ✗
Firewalls automatically promote the secondary Panorama node to primary and synchronize state tables.
Why it's wrong here
In a split-brain scenario where heartbeat is lost, both nodes may attempt to assume primary roles, but firewalls cannot synchronize if network connectivity between Panoramas is severed.
About these practice questions
Courseiva writes every NetSec-Architect question from scratch — 228 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This NetSec-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NetSec-Architect exam.