NetSec-Architect Practice Question: Centralized Management And Security Automation AT Scale
An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Panorama pushed a configuration referencing an object that exists in Panorama but has not been successfully committed and pushed to that specific device group context.
Out-of-sync states occur when local changes are made on the firewall, when a Panorama push fails partway, or when object references mismatch between device group and local scopes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall's physical data plane interface suffered a physical cable disconnect.
Why it's wrong here
Physical link drops affect data plane traffic, not Panorama configuration synchronization.
- ✓
Panorama pushed a configuration referencing an object that exists in Panorama but has not been successfully committed and pushed to that specific device group context.
Why this is correct
Missing object references cause validation errors during pushes, leaving the firewall out of sync.
- ✗
The firewall's SSL decryption certificate expired, causing management plane authentication failure.
Why it's wrong here
Decryption certificates do not cause Panorama-firewall configuration sync status issues.
- ✓
A previous configuration push from Panorama failed or was partially applied due to a validation error on the firewall.
Why this is correct
If a push fails or is only partially successful, the firewall running configuration will not match Panorama's candidate configuration.
- ✓
Local configuration changes were made directly on the managed firewall CLI or WebUI, causing configuration drift.
Why this is correct
Making local changes on a firewall managed by Panorama creates a divergence between the firewall's running configuration and Panorama's expected state.
About these practice questions
This NetSec-Architect question is part of Courseiva's 228-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This NetSec-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NetSec-Architect exam.