Troubleshooting practice questions

You are troubleshooting a connection that is being blocked despite a matching policy. Which tool is best for determining which specific rule is hitting the traffic?

Trap 1: Packet Capture (pcap)

Pcap shows the packet content, not necessarily the policy match logic.

Trap 2: GlobalProtect logs

This is for VPN logs only.

Trap 3: Traffic Monitor

Traffic monitor shows history, but the test command is the diagnostic tool.

A
Packet Capture (pcap)
Why wrong: Pcap shows the packet content, not necessarily the policy match logic.
B
GlobalProtect logs
Why wrong: This is for VPN logs only.
C
Policy Test Tool (test security-policy-match)
This command simulates traffic and returns the matching rule.
D
Traffic Monitor
Why wrong: Traffic monitor shows history, but the test command is the diagnostic tool.

Open the full BGP breakdown →

Question 2mediummultiple choice

When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?

Trap 1: Traffic logs

Traffic logs record session data, not BGP control plane state.

Trap 2: Threat logs

Threat logs monitor for malicious activity.

Trap 3: Config logs

Config logs track changes made by administrators.

A
Traffic logs
Why wrong: Traffic logs record session data, not BGP control plane state.
B
System logs
BGP status changes are logged under the System category.
C
Threat logs
Why wrong: Threat logs monitor for malicious activity.
D
Config logs
Why wrong: Config logs track changes made by administrators.

Read the full VPN explanation →

Question 3hardmultiple choice

When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?

Trap 1: Mismatched DH Group in Phase 2.

Phase 2 mismatches usually result in 'QM-Idle' or other errors after Phase 1 succeeds.

Trap 2: Incorrect Proxy-ID settings.

Proxy-ID issues are usually detected during the tunnel establishment attempt.

Trap 3: Expired certificate on the peer.

Certificate issues would prevent the completion of authentication, not the initial packet exchange.

A
Mismatched DH Group in Phase 2.
Why wrong: Phase 2 mismatches usually result in 'QM-Idle' or other errors after Phase 1 succeeds.
B
Incorrect peer IP address or network connectivity blocking UDP 500/4500.
If the peer doesn't respond to IKE negotiation, the state remains INIT.
C
Incorrect Proxy-ID settings.
Why wrong: Proxy-ID issues are usually detected during the tunnel establishment attempt.
D
Expired certificate on the peer.
Why wrong: Certificate issues would prevent the completion of authentication, not the initial packet exchange.

Question 4hardmulti select

Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?

Trap 1: Verify the MAC address table.

MAC address tables do not affect App-ID identification.

Trap 2: Check the system clock synchronization.

While good practice, it does not impact application identification.

A
Verify the MAC address table.
Why wrong: MAC address tables do not affect App-ID identification.
B
Ensure the App-ID override policy is correctly configured for the traffic.
Overrides force the identification if the engine cannot determine the app.
C
Check the system clock synchronization.
Why wrong: While good practice, it does not impact application identification.
D
Check if SSL decryption is required to inspect the application traffic.
Encrypted traffic may be identified generically if not decrypted.
E
Verify the application is not being misidentified due to non-standard ports.
App-ID can fail if traffic uses non-standard ports without proper overrides.

Question 5mediummultiple choice

You are troubleshooting an application that is being blocked despite having an Allow security policy. You observe in the Traffic Log that the App-ID is identified as 'incomplete'. What is the most likely cause?

Trap 1: The Security Policy is missing a Decryption Profile.

Lack of decryption would result in 'unknown-tcp', not 'incomplete'.

Trap 2: The App-ID database is outdated.

An outdated database might misidentify an app, but not cause an 'incomplete' status.

Trap 3: The application is using a custom port not defined in the Service…

This would likely result in an 'unknown' or 'not-applicable' App-ID.

A
The Security Policy is missing a Decryption Profile.
Why wrong: Lack of decryption would result in 'unknown-tcp', not 'incomplete'.
B
The App-ID database is outdated.
Why wrong: An outdated database might misidentify an app, but not cause an 'incomplete' status.
C
The client sent a SYN packet but the server did not respond.
Incomplete sessions are often caused by the firewall seeing the start of a flow but no further packets to finalize the handshake.
D
The application is using a custom port not defined in the Service object.
Why wrong: This would likely result in an 'unknown' or 'not-applicable' App-ID.

Question 6mediummultiple choice

An administrator observes that dynamic updates for App-ID and Threat signatures are failing. Which troubleshooting step should be performed first?

Trap 1: Restart the management plane process using the 'debug software…

Restarting the management plane is disruptive and should not be the first step.

Trap 2: Rebuild the configuration database using 'request system…

This would wipe the entire device configuration, which is catastrophic.

Trap 3: Increase the timeout value in the 'Device > Setup > Management' tab.

Timeout settings rarely resolve update connectivity issues compared to license or routing issues.

A
Restart the management plane process using the 'debug software restart process management-plane' command.
Why wrong: Restarting the management plane is disruptive and should not be the first step.
B
Rebuild the configuration database using 'request system reset-config'.
Why wrong: This would wipe the entire device configuration, which is catastrophic.
C
Increase the timeout value in the 'Device > Setup > Management' tab.
Why wrong: Timeout settings rarely resolve update connectivity issues compared to license or routing issues.
D
Check the 'Device > Licenses' page to ensure the 'Threat Prevention' or 'PAN-DB' subscription is active.
Without an active subscription, dynamic updates cannot be downloaded or installed.

Question 7hardmultiple choice

You are troubleshooting a connectivity issue between an SCM-managed firewall and the SCM cloud service. Which log source in the firewall UI provides the most detailed information regarding the management connection?

Trap 1: Configuration logs

These logs only show changes to the configuration, not connection status.

Trap 2: Threat logs

These logs show security-related events.

Trap 3: Traffic logs

Traffic logs show data plane traffic, not management plane connectivity.

A
Configuration logs
Why wrong: These logs only show changes to the configuration, not connection status.
B
Threat logs
Why wrong: These logs show security-related events.
C
Traffic logs
Why wrong: Traffic logs show data plane traffic, not management plane connectivity.
D
System logs
System logs contain events related to the management service and connectivity to SCM.

Question 8hardmultiple choice

You are troubleshooting a scenario where internal users cannot access an external server. The traffic log shows the traffic is 'allowed', but the byte count is 0. What is the most likely cause?

Trap 1: The NAT policy is missing.

If NAT were missing, the session would still show bytes if the connection reached the server.

Trap 2: The Security Policy is misconfigured.

If it were a policy issue, the traffic would show as 'dropped' or 'rejected' in the logs.

Trap 3: App-ID is failing to identify the traffic.

If App-ID failed, the traffic would show 'incomplete' but would likely have some byte count.

A
The NAT policy is missing.
Why wrong: If NAT were missing, the session would still show bytes if the connection reached the server.
B
The Security Policy is misconfigured.
Why wrong: If it were a policy issue, the traffic would show as 'dropped' or 'rejected' in the logs.
C
MTU mismatch causing packet drops in the return path.
If the return path has a smaller MTU, packets will be dropped, resulting in no data transfer.
D
App-ID is failing to identify the traffic.
Why wrong: If App-ID failed, the traffic would show 'incomplete' but would likely have some byte count.

Question 9hardmultiple choice

You are troubleshooting a performance issue in Prisma Access. Users report slow access to SaaS applications. You suspect the issue is related to the path selection. Which tool should you use to analyze the latency between the user's mobile client and the Service Connection?

Trap 1: Traffic Logs in Panorama

Traffic logs show session outcome, not real-time path latency metrics.

Trap 2: GlobalProtect App logs

These show local client status, not network path telemetry.

Trap 3: ACC (Application Command Center)

ACC provides traffic trends, not path latency.

A
Traffic Logs in Panorama
Why wrong: Traffic logs show session outcome, not real-time path latency metrics.
B
GlobalProtect App logs
Why wrong: These show local client status, not network path telemetry.
C
Prisma Access Insights
Prisma Access Insights is designed specifically for monitoring performance and latency.
D
ACC (Application Command Center)
Why wrong: ACC provides traffic trends, not path latency.

Question 10mediummulti select

Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?

Trap 1: Decryption Logs.

Decryption logs are only for encrypted sessions.

Trap 2: Config Logs.

Config logs are for changes, not traffic status.

Trap 3: Threat Logs.

Threat logs are for malicious activity, not standard traffic.

A
System Logs.
System logs show interface or route events.
B
Decryption Logs.
Why wrong: Decryption logs are only for encrypted sessions.
C
Traffic Logs.
Traffic logs show if the flow was allowed or denied.
D
Config Logs.
Why wrong: Config logs are for changes, not traffic status.
E
Threat Logs.
Why wrong: Threat logs are for malicious activity, not standard traffic.

Question 11hardmultiple choice

You are troubleshooting an issue where a specific Threat Prevention profile is not applying correctly via Panorama. The setting is configured in a Template, but the firewall shows a different value. What should you check?

Trap 1: The local device group lockdown setting.

Lockdown prevents changes, it doesn't cause value mismatches.

Trap 2: The Panorama log collector status.

Log collection is unrelated to configuration push precedence.

Trap 3: The firewall's OS version compatibility.

While OS versions matter, they usually result in total push failures, not specific profile value mismatches.

A
The local device group lockdown setting.
Why wrong: Lockdown prevents changes, it doesn't cause value mismatches.
B
The Panorama log collector status.
Why wrong: Log collection is unrelated to configuration push precedence.
C
The firewall's OS version compatibility.
Why wrong: While OS versions matter, they usually result in total push failures, not specific profile value mismatches.
D
The order of the templates within the Template Stack.
Templates at the top of the stack override those at the bottom.