Knowledge + Practice

CCNA Device Mgmt Services Questions

75 of 116 questions · Page 1/2 · Device Mgmt Services topic · Answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

A company has two Palo Alto Networks firewalls in active/passive HA. The passive firewall failed and was replaced with a new unit. The network administrator initiates a configuration sync from the active to the new passive. After the sync, the passive unit shows as 'Active' instead of 'Passive'. What is the most likely cause?

A.The HA link is misconfigured on both units.

B.The passive unit's HA configuration was set to 'Stateful Inspection' instead of 'Passive'.

C.The active firewall's HA settings were missing the new device's serial number.

D.The passive unit had a different version of Panorama template.

AnswerC

Missing serial number prevents authentication, causing passive to become active.

Why this answer

Option C is correct because in an active/passive HA pair, the active firewall maintains a list of allowed peer serial numbers. If the new passive unit's serial number is not included in the active firewall's HA configuration, the active will not recognize the passive as a valid peer. Consequently, the passive unit, lacking a proper HA heartbeat from the active, will assume the active role (become 'Active') due to a loss of the HA link or misidentification, as it defaults to active state when it cannot establish a proper HA relationship.

Exam trap

The trap here is that candidates often assume a configuration sync will automatically update the peer serial number or that the HA role is determined solely by the 'device priority' setting, overlooking the explicit serial number validation required for HA peer authentication.

How to eliminate wrong answers

Option A is wrong because a misconfigured HA link (e.g., incorrect IP addresses or subnet masks on the HA control/data interfaces) would prevent the units from communicating, but it would not specifically cause the passive to become 'Active'—both units would likely show as 'Active' or 'Non-Functional' due to loss of heartbeat, not a targeted role flip. Option B is wrong because 'Stateful Inspection' is not an HA role setting; HA roles are 'Active' or 'Passive', and 'Stateful Inspection' refers to a firewall feature for session tracking, not an HA configuration option. Option D is wrong because Panorama template version differences affect policy and object synchronization, not the HA state or role election; the HA state is determined by local HA configuration and peer serial number validation, not Panorama templates.

Practice this question →

2

MCQhard

A company is deploying multiple Palo Alto firewalls and wants to manage them centrally. Which method should be used?

A.Use Panorama

B.Use CLI scripts

C.Use a dedicated management server

D.Use SNMP

AnswerA

Panorama is designed for centralized management.

Why this answer

Panorama is the centralized management solution for Palo Alto Networks firewalls, providing a single pane of glass for policy management, log aggregation, and device configuration across multiple firewalls. It uses a dedicated management plane that communicates with firewalls via the management interface (MGT) or in-band using IPsec tunnels, ensuring consistent policy enforcement and simplified administration.

Exam trap

The trap here is that candidates often confuse centralized management with generic monitoring tools like SNMP or assume any dedicated server can replace Panorama, but only Panorama provides the full suite of centralized policy management, log collection, and device orchestration specific to Palo Alto firewalls.

How to eliminate wrong answers

Option B is wrong because CLI scripts are used for automation on individual firewalls but lack centralized visibility, log aggregation, and policy conflict detection that Panorama provides. Option C is wrong because a dedicated management server is a generic concept; Palo Alto Networks specifically requires Panorama (physical or virtual appliance) for centralized management, not any generic server. Option D is wrong because SNMP is a monitoring protocol for reading device statistics and sending traps, not for managing firewall policies or configurations centrally.

Practice this question →

3

MCQmedium

An administrator needs to generate a report showing all applications used by a specific user group over the past week. Which method is most efficient?

A.Export Traffic logs to CSV and analyze in Excel

B.Use the Top Applications report in the Reports tab

C.Use the ACC (Application Command Center) and filter by user group and time range

D.Use the Monitor tab's Session Browser with a filter for the user group

AnswerC

ACC provides a customizable dashboard with historical data by application and user group.

Why this answer

The ACC (Application Command Center) is purpose-built for rapid application visibility and analysis. By filtering by user group and time range directly within the ACC, the administrator can instantly see the top applications used by that group without exporting or manually parsing logs, making it the most efficient method for this specific reporting need.

Exam trap

The trap here is that candidates confuse the Session Browser (for live sessions) with the ACC (for historical application analytics), or assume that exporting logs to Excel is a valid 'efficient' method, when Cisco tests the understanding that the ACC is the dedicated tool for application-centric reporting.

How to eliminate wrong answers

Option A is wrong because exporting Traffic logs to CSV and analyzing in Excel is inefficient and manual; it requires extra steps and lacks real-time filtering by user group. Option B is wrong because the Top Applications report in the Reports tab is a static, scheduled report that cannot be dynamically filtered by a specific user group for an ad-hoc time range. Option D is wrong because the Monitor tab's Session Browser is designed for real-time session monitoring and troubleshooting, not for generating a historical summary report of applications used over a past week.

Practice this question →

4

MCQmedium

Refer to the exhibit. What is the status of the commit job?

A.Completed

B.Canceled

C.Failed

D.Pending

AnswerD

The output clearly shows 'Pending' as the status.

Why this answer

The commit job status is 'Pending' because the commit operation has been initiated but not yet completed. In Palo Alto Networks firewalls, when a commit is in progress, the job status shows as 'Pending' until the configuration is successfully applied or an error occurs. The exhibit likely shows a commit job with a status of 'Pending', indicating that the system is still processing the configuration changes.

Exam trap

Palo Alto Networks often tests the distinction between 'Pending' and 'Failed' by showing a commit job that appears stuck or slow, leading candidates to assume it has failed when it is actually still processing.

How to eliminate wrong answers

Option A is wrong because 'Completed' would indicate that the commit job has finished successfully, but the exhibit shows the job is still in progress. Option B is wrong because 'Canceled' would mean the commit was manually aborted or timed out, which is not indicated by a 'Pending' status. Option C is wrong because 'Failed' would mean the commit encountered an error and did not apply the configuration, whereas 'Pending' means the job is still running and has not yet reached a final state.

Practice this question →

5

Multi-Selecthard

A company is deploying a PA-220 firewall in a branch office. The firewall will be managed by Panorama. Which THREE of the following are required to establish a successful connection between the firewall and Panorama?

Select 3 answers

A.Configuration of the Panorama IP address on the firewall

B.DNS resolution for the Panorama hostname

C.A valid Panorama auth key on the firewall

D.A DHCP server to assign an IP to the management interface

E.Network connectivity between the firewall and Panorama

AnswersA, C, E

The firewall needs to know where to connect.

Why this answer

Option A is correct because the firewall must be configured with the Panorama IP address (or hostname) to initiate the management connection. This is typically done via the Panorama tab in the web interface or CLI using the 'set deviceconfig system panorama-server <IP>' command. Without this configuration, the firewall does not know where to send its registration and operational data.

Exam trap

The trap here is that candidates often assume DNS resolution is mandatory for Panorama connectivity, but it is only needed if the Panorama server is specified by hostname rather than IP address.

Practice this question →

6

MCQeasy

A company has a pair of PA-5220 firewalls configured in an active/passive high-availability (HA) cluster. The devices are managed via Panorama, which also manages other firewalls. The security team reports that after a recent commit on Panorama, the passive firewall in the HA pair stops responding to management pings. The active firewall continues to pass traffic and is manageable. Upon investigation, the passive firewall shows the following on its console: 'Management plane is down.' The administrator suspects the passive firewall might have received a configuration that disables the management interface. What should the administrator do to restore management access to the passive firewall without affecting production traffic?

A.From the active firewall CLI, run 'request high-availability sync-to-remote running-config'.

B.Access the passive firewall via the console port and enter the password recovery mode to reset the management interface configuration.

C.Disconnect the HA link and reset the passive firewall to factory defaults.

D.Reboot the passive firewall to load the previous running configuration.

AnswerB

Password recovery mode allows resetting management access without affecting other configurations.

Why this answer

Option B is correct because when the passive firewall's management plane is down and it is unresponsive to management pings, console access is the only way to interact with it. Password recovery mode allows the administrator to reset the management interface configuration without affecting the active firewall or production traffic, as the passive firewall is not forwarding data traffic in an active/passive HA cluster.

Exam trap

The trap here is that candidates assume a reboot or configuration sync will fix the issue, but they fail to recognize that the passive firewall's management plane is down due to a committed configuration error, requiring console-based recovery to restore management access without disrupting the active firewall.

How to eliminate wrong answers

Option A is wrong because 'request high-availability sync-to-remote running-config' synchronizes the running configuration from the active to the passive firewall, but if the passive firewall's management interface is disabled, it cannot receive or apply the sync, and the command does not address the management plane being down. Option C is wrong because disconnecting the HA link and resetting the passive firewall to factory defaults is overly destructive, would erase all configuration, and would require full reconfiguration and re-synchronization, unnecessarily impacting the HA pair's readiness. Option D is wrong because rebooting the passive firewall will load the same committed configuration that caused the management interface to be disabled; it does not revert to a previous running configuration unless a prior commit was saved, and the issue is a configuration error, not a transient software fault.

Practice this question →

7

MCQmedium

A firewall administrator notices that after a power outage, the firewall boots up but fails to load the last committed configuration. What should the administrator do to recover the configuration?

A.Perform a factory reset

B.Load a config file from the previous backup

C.Reinstall the PAN-OS image

D.Use the 'load config from' command via CLI to restore from the most recent saved config

AnswerD

Direct method to load a saved configuration file.

Why this answer

Option D is correct because the 'load config from' CLI command allows the administrator to load a previously saved configuration file (e.g., from the most recent backup) into the running configuration without affecting the startup configuration. After loading, the administrator must commit the configuration to make it persistent. This is the standard recovery method when the last committed configuration fails to load after a reboot, as the firewall retains saved configuration files in its filesystem.

Exam trap

The trap here is that candidates may confuse the 'load config from' command with a factory reset or OS reinstall, assuming a corrupted boot requires a full system restore, when in fact the configuration files are often still accessible and can be reloaded via CLI.

How to eliminate wrong answers

Option A is wrong because a factory reset erases all configurations, including any saved backups, and is only used as a last resort when no configuration can be recovered. Option B is wrong because loading a config file from a previous backup is vague and does not specify the correct CLI command; the proper method is to use the 'load config from' command to load a specific file, not just any backup. Option C is wrong because reinstalling the PAN-OS image is unnecessary and destructive; it would wipe the system and require complete reconfiguration, whereas the issue is only with the configuration file, not the operating system.

Practice this question →

8

Multi-Selecthard

An administrator wants to schedule regular configuration backups to an external server. Which THREE methods are valid ways to achieve this? (Choose three.)

Select 3 answers

A.Use a script that logs in via SSH and runs 'save config to scp/tftp'

B.Use the CLI command 'request system backup config schedule'

C.Configure a scheduled backup via the web UI under Device > Setup > Operations

D.Set a recurring cron job via the firewall's built-in cron

E.Use Panorama to schedule backups for managed firewalls

AnswersA, C, E

Correct: External scripts can perform backups manually.

Why this answer

Option A is correct because the firewall supports saving configuration backups to external servers via SCP or TFTP using the 'save config to scp/tftp' CLI command. This method can be automated by wrapping the command in a script that runs on an external scheduler (e.g., cron on a Linux host), which then connects to the firewall via SSH to execute the backup. This is a valid, albeit indirect, way to schedule regular backups.

Exam trap

The trap here is that candidates may assume the firewall has a native CLI command to schedule backups (Option B) or that the built-in cron is user-configurable (Option D), when in fact PAN-OS restricts scheduling to the web UI and Panorama to maintain security and consistency.

Practice this question →

9

Multi-Selectmedium

Which TWO of the following are valid methods to upgrade the PAN-OS version on a Palo Alto Networks firewall?

Select 2 answers

A.Using the GUI under Device > Dynamic Updates > Software

B.Using the CLI command 'request system software upgrade install version <version>'

C.Using the GUI under Device > Dynamic Updates > Content Updates

D.Downloading the image via SCP and using 'load software'

E.Using Panorama's 'Software' tab to push an upgrade to the firewall

AnswersA, B

The GUI method is under Device > Dynamic Updates > Software.

Why this answer

Option A is correct because the PAN-OS software upgrade can be initiated via the GUI under Device > Dynamic Updates > Software, where administrators can download and install new PAN-OS versions. This is a standard method for upgrading the firewall's operating system through the web interface.

Exam trap

The trap here is confusing content updates (signatures) with software updates (PAN-OS version), leading candidates to select the Content Updates path as a valid upgrade method.

Practice this question →

10

MCQeasy

An administrator modifies a security policy but the change does not take effect. What must the administrator do?

A.Commit the configuration.

B.Import the configuration.

C.Save the configuration.

D.Reboot the firewall.

AnswerA

Changes must be committed to become active.

Why this answer

In Palo Alto Networks firewalls, configuration changes are made in a candidate configuration that is not active until explicitly committed. The administrator must commit the configuration to apply the changes to the running configuration and enforce the new security policy. Without a commit, the modification remains pending and does not affect traffic.

Exam trap

Palo Alto Networks often tests the misconception that saving a configuration (e.g., via 'save config' or clicking Save) is sufficient to apply changes, but in Palo Alto firewalls, a commit is mandatory to move changes from candidate to active state.

How to eliminate wrong answers

Option B is wrong because importing a configuration is used to load a configuration file from an external source, not to apply pending changes. Option C is wrong because saving the configuration in the GUI or CLI only stores the candidate configuration to persistent storage but does not activate it; a commit is still required. Option D is wrong because rebooting the firewall would cause downtime and does not apply uncommitted changes; the candidate configuration would be lost if not saved, and even if saved, a commit is still necessary to activate it.

Practice this question →

11

Matchingmedium

Match each Palo Alto Networks feature to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Identifies applications regardless of port

Maps IP addresses to usernames

Inspects files and data for threats

Cloud-based malware analysis

VPN client for remote access

Why these pairings

These are core Palo Alto Networks security features.

Practice this question →

12

MCQmedium

An administrator configures SNMP monitoring on a firewall but receives no data from the SNMP manager. Which check should be performed first?

A.Check that the SNMP manager supports SNMPv3

B.Verify that the firewall's management IP is reachable from the SNMP manager

C.Ensure the SNMP manager is running on the same subnet as the firewall

D.Verify the SNMP community string and allowed management IPs in the SNMP server profile

AnswerD

These are essential for SNMP access.

Why this answer

The most common cause of SNMP monitoring failure after initial configuration is a mismatch in the SNMP community string (for SNMPv2c) or authentication credentials, or the SNMP manager's IP not being permitted in the SNMP server profile. The SNMP server profile on the firewall explicitly defines which community strings and manager IPs are allowed to poll the device. If these are incorrect, the firewall will silently drop SNMP requests, even if network connectivity is fine.

Exam trap

The trap here is that candidates often assume the problem is network connectivity (Option B) or subnet mismatch (Option C), but the PCNSA exam emphasizes that SNMP-specific configuration errors—especially the community string and allowed IP list—are the most frequent first-check items.

How to eliminate wrong answers

Option A is wrong because the question does not specify which SNMP version is configured; checking manager support for SNMPv3 is irrelevant if the firewall is using SNMPv2c or if the issue is a community string mismatch. Option B is wrong because basic IP reachability is a lower-layer check that should be performed after verifying the SNMP-specific configuration, as the firewall may still drop SNMP packets even if pingable. Option C is wrong because SNMP managers can poll firewalls across different subnets via routed networks; there is no requirement for them to be on the same subnet.

Practice this question →

13

MCQeasy

A network engineer wants to configure a new VLAN interface on a Palo Alto Networks firewall. After creating the VLAN object and assigning it to an Ethernet interface, the VLAN interface remains down. What is the most likely cause?

A.The VLAN interface needs an IP address configured

B.The VLAN interface must be assigned to a virtual router

C.The firewall needs a commit to apply the changes

D.The Ethernet interface is not set to layer 2 mode or the VLAN tag is not allowed

AnswerD

For a VLAN interface to be up, the parent Ethernet interface must be in layer 2 mode and the VLAN tag must be in the allowed list.

Why this answer

For a VLAN interface to be operational on a Palo Alto Networks firewall, the underlying Ethernet interface must be configured in Layer 2 mode and the specific VLAN tag must be allowed on that interface. If the Ethernet interface remains in Layer 3 mode or the VLAN tag is not included in the allowed list, the VLAN interface will remain administratively down, as it cannot associate with a physical port that is not set to accept VLAN traffic.

Exam trap

The trap here is that candidates often assume a VLAN interface only needs an IP address or a virtual router assignment to come up, overlooking the prerequisite that the parent Ethernet interface must be in Layer 2 mode with the VLAN tag allowed.

How to eliminate wrong answers

Option A is wrong because a VLAN interface can be created without an IP address and still be administratively up; an IP address is only required for routing or management access, not for the interface to come up. Option B is wrong because assigning a VLAN interface to a virtual router is necessary for Layer 3 forwarding, but the interface will still show as down if the underlying Ethernet port is not in Layer 2 mode or the VLAN tag is not allowed. Option C is wrong because while a commit is required to make configuration changes permanent, the VLAN interface will remain down even after a commit if the Ethernet interface is not properly configured for VLAN tagging.

Practice this question →

14

MCQmedium

A company has two PA-220 firewalls in active/passive HA. They want to ensure that if the active firewall loses internet connectivity but its management interface remains up, a failover occurs. Which monitoring method should be configured?

A.Path monitoring.

B.Heartbeat backup.

C.Session replication.

D.Link monitoring on all interfaces.

AnswerA

Correct: Path monitoring verifies reachability to a target IP and triggers failover if unreachable.

Why this answer

Path monitoring is the correct method because it monitors the dataplane connectivity to specific destination IP addresses (e.g., the internet gateway) and triggers a failover when those paths become unreachable, even if the management interface remains up. This ensures that the active firewall fails over based on actual data traffic path health, not just link or management status.

Exam trap

The trap here is that candidates often confuse 'link monitoring' (which only checks local interface status) with 'path monitoring' (which checks end-to-end connectivity to a remote target), leading them to select link monitoring when the question explicitly requires detection of internet connectivity loss beyond the first hop.

How to eliminate wrong answers

Option B (Heartbeat backup) is wrong because heartbeat backup refers to the HA control link used for state synchronization and peer liveness detection, not for monitoring external path connectivity. Option C (Session replication) is wrong because session replication is a mechanism to mirror active sessions to the passive firewall for stateful failover, not a monitoring method to detect path loss. Option D (Link monitoring on all interfaces) is wrong because link monitoring only detects physical link state changes (up/down) on local interfaces, not the loss of internet connectivity beyond the first hop.

Practice this question →

15

MCQhard

An organization needs to send threat logs to two different syslog servers: one for real-time alerts and one for long-term storage. They also need to send traffic logs to the long-term storage syslog only. They have configured two syslog server profiles. What is the correct approach?

A.Create two separate log forwarding profiles, one for threat logs with both syslog profiles, and one for traffic logs with only the long-term storage profile.

B.Use the default log forwarding settings and configure the syslog servers globally.

C.Create a single log forwarding profile with both syslog profiles and assign it to all rules.

D.Configure each firewall rule to specify which syslog server to send logs to.

AnswerA

Correct: Separate profiles allow different log types to be sent to different destinations.

Why this answer

Option A is correct because Palo Alto Networks firewalls use separate log forwarding profiles to control which logs are sent to which syslog servers. By creating two profiles—one for threat logs that includes both syslog server profiles (real-time and long-term storage) and one for traffic logs that includes only the long-term storage profile—the organization can selectively route logs to meet their requirements. This approach leverages the firewall's ability to assign different log forwarding profiles to different log types, ensuring granular control over log distribution.

Exam trap

The trap here is that candidates often assume a single log forwarding profile can be assigned to multiple log types with different server destinations, but Palo Alto requires separate profiles to achieve selective routing, as a single profile applies all its servers to all logs it covers.

How to eliminate wrong answers

Option B is wrong because the default log forwarding settings do not allow selective routing to multiple syslog servers; they apply a single global configuration that cannot differentiate between log types or servers. Option C is wrong because a single log forwarding profile with both syslog profiles would send both threat and traffic logs to both servers, failing the requirement to send traffic logs only to long-term storage. Option D is wrong because firewall rules do not directly specify syslog servers; log forwarding is configured via log forwarding profiles, not per-rule syslog server assignments.

Practice this question →

16

MCQmedium

An administrator configured SNMP community and trap destination under Device > Setup > Services, but no traps are received. What additional configuration is needed?

A.Set the source interface

B.Configure SNMP version

C.Create a security policy

D.Add a management profile that allows SNMP

E.Enable SNMP on the interface

AnswerD

The management profile must permit SNMP access to the management interface.

Why this answer

Option D is correct because even after configuring SNMP communities and trap destinations under Device > Setup > Services, the firewall still requires a management profile that explicitly permits SNMP (and optionally traps) on the interface through which the traps will be sent. Without this profile applied to the interface, the firewall will not allow SNMP traffic to egress, and traps will be silently dropped.

Exam trap

Palo Alto Networks often tests the misconception that configuring SNMP under Device > Setup is sufficient, but the trap here is that candidates forget the management profile is a separate, mandatory step to authorize SNMP traffic on the egress interface.

How to eliminate wrong answers

Option A is wrong because setting the source interface is optional and only needed when you want to force traps to originate from a specific IP address; it is not a prerequisite for trap delivery. Option B is wrong because SNMP version is already implicitly selected when you configure the community string (v2c) or user (v3) under the SNMP setup; no separate version configuration is required. Option C is wrong because security policies control inter-zone traffic, but SNMP traps are generated locally by the firewall and egress via the management plane, not through a dataplane security policy.

Option E is wrong because SNMP is not 'enabled' on an interface like a service; instead, you must attach a management profile that includes SNMP to the interface to allow the firewall to send traps out that interface.

Practice this question →

17

MCQhard

A security analyst uses Panorama to generate a custom report on all traffic using the application 'facebook-base' across the enterprise. The analyst creates a new report template in Panorama with the filter '(app eq facebook-base)' and runs the report for the past 30 days. The report returns zero results. However, when the analyst logs into a specific firewall and queries the traffic logs using the same filter, results appear. The analyst confirms that the firewall is configured to forward logs to Panorama and that Panorama receives logs from all firewalls. What is the most likely reason the Panorama report fails to return data?

A.The application filter must specify the parent application 'facebook' because 'facebook-base' is a sub-application.

B.Panorama only supports scheduled reports, not ad-hoc queries.

C.The report template is not committed to the device group.

D.The firewall's log forwarding profile must be set to send logs to Panorama on a separate port.

AnswerA

Panorama requires the parent application for sub-application filters.

Why this answer

In Panorama, application filters require the parent application name when filtering by sub-application. 'facebook-base' is a sub-application of 'facebook', so the correct filter should be '(app eq facebook)(subapp eq facebook-base)'. Option A (commit to device group) is not required for reports. Option C (scheduled only) is false.

Option D (separate port) is incorrect.

Practice this question →

18

MCQmedium

A firewall is configured with multiple Virtual Systems (vsys). An admin wants to assign a custom admin role that can manage only specific vsys. Which role type supports this?

A.Panorama Admin

B.Read Only Admin

C.Virtual System Admin

D.Superadmin

E.Device Admin

AnswerC

Can be assigned to specific vsys with tailored permissions.

Why this answer

Option C is correct because the Virtual System Admin role is specifically designed to grant administrative access to one or more Virtual Systems (vsys) within a Palo Alto Networks firewall. This role type allows the admin to manage only the assigned vsys, with no visibility or control over other vsys or the shared firewall configuration, which directly matches the requirement in the question.

Exam trap

The trap here is that candidates often confuse 'Virtual System Admin' with 'Device Admin' or 'Read Only Admin,' assuming that any admin role can be scoped to a vsys, but only the Virtual System Admin role provides the granular per-vsys restriction required.

How to eliminate wrong answers

Option A is wrong because Panorama Admin is a role used for managing Panorama, the centralized management platform, not for assigning per-vsys administrative access on a firewall. Option B is wrong because Read Only Admin provides read-only access to the entire firewall configuration, including all vsys, and cannot be scoped to specific vsys. Option D is wrong because Superadmin has full, unrestricted access to all vsys and all firewall settings, which is the opposite of the required restricted access.

Option E is wrong because Device Admin is a role that manages device-level settings (e.g., network interfaces, certificates) across all vsys, not limited to specific vsys.

Practice this question →

19

Multi-Selectmedium

Which TWO of the following are required when configuring a new virtual router on a Palo Alto Networks firewall?

Select 2 answers

A.Set the administrative distance for the default route

B.Define at least one static route or enable a dynamic routing protocol

C.Configure OSPF as the routing protocol

D.Configure route redistribution

E.Assign at least one layer 3 interface to the virtual router

AnswersB, E

A route is needed to forward traffic.

Why this answer

When configuring a new virtual router on a Palo Alto Networks firewall, you must assign at least one Layer 3 interface to it (Option E) so that the virtual router can participate in routing. Additionally, you must define at least one static route or enable a dynamic routing protocol (Option B) to provide a path for traffic; otherwise, the virtual router has no forwarding information and cannot route packets.

Exam trap

The trap here is that candidates often assume a dynamic routing protocol like OSPF is mandatory, but Palo Alto firewalls allow static routes as a perfectly valid and minimal routing configuration for a virtual router.

Practice this question →

20

MCQhard

An administrator wants to allow ping (ICMP) and SSH access on a data interface (e.g., ethernet1/1) for troubleshooting. Which configuration is required?

A.Enable 'Management' profile on the VLAN interface

B.Configure an interface management profile on ethernet1/1

C.Create a security policy allowing ICMP and SSH inbound

D.Enable the service route for ping and SSH

AnswerB

Interface management profiles control which management services are permitted on a data interface.

Why this answer

Interface management profiles control which management services (ping, SSH, HTTP, etc.) are permitted on a data interface.

Practice this question →

21

MCQhard

A company uses Panorama to manage multiple firewalls. They have configured a template to push NTP settings, DNS, and authentication profiles. However, one firewall is not receiving the template settings. Which of the following is the most likely cause?

A.The template was not committed to Panorama

B.The firewall is not in the template's device group

C.The firewall has a local configuration that overrides the template

D.The firewall's management IP is not reachable from Panorama

AnswerD

If unreachable, Panorama cannot push templates.

Why this answer

Panorama pushes template settings to managed firewalls via a management-plane connection. If the firewall's management IP is not reachable from Panorama (e.g., due to network issues, incorrect IP, or routing problems), the template cannot be applied. This is the most direct cause of a firewall not receiving template settings, as Panorama requires reachability to commit and push configurations.

Exam trap

The trap here is confusing device groups with template assignment; candidates often think a firewall must be in a device group to receive template settings, but templates are assigned directly to firewalls or template stacks, not through device groups.

How to eliminate wrong answers

Option A is wrong because if the template was not committed to Panorama, no firewall would receive the settings, not just one specific firewall. Option B is wrong because templates are associated with firewalls directly, not through device groups; device groups are for policy objects, while templates are assigned to firewalls via template stacks. Option C is wrong because local configurations on a firewall can override template settings only if the firewall is configured to use local settings over Panorama (e.g., via 'local-override' flag), but this is a deliberate configuration choice, not a typical cause of failure to receive template settings; the question implies the firewall is not receiving them at all, not that it is overriding them.

Practice this question →

22

MCQeasy

A company needs to receive email alerts for critical system events. What is the recommended method to configure email notifications on a Palo Alto Networks firewall?

A.Create an Email server profile under Device > Server Profiles with SMTP settings

B.Configure an SNMP trap receiver to forward events to email

C.Enable ICMP echo replies to trigger email via a separate scripting tool

D.Set up a syslog server that sends email alerts

AnswerA

This is the standard method for email alerts.

Why this answer

Option A is correct because Palo Alto Networks firewalls provide a native Email Server Profile under Device > Server Profiles that allows direct SMTP configuration for sending email alerts. This is the recommended method as it integrates directly with the firewall's alerting system without requiring external tools or services.

Exam trap

The trap here is that candidates may confuse syslog or SNMP as direct email notification methods, but Palo Alto Networks firewalls require a dedicated Email Server Profile for native SMTP-based alerting, and other methods like syslog or SNMP need additional infrastructure to generate emails.

How to eliminate wrong answers

Option B is wrong because SNMP trap receivers forward traps to an SNMP manager, not directly to email; they require additional translation or middleware to convert traps into email messages, which is not a recommended or native method. Option C is wrong because ICMP echo replies are a network diagnostic tool and have no mechanism to trigger email alerts; this would require a separate scripting tool and is not a supported configuration on the firewall. Option D is wrong because syslog servers forward log messages to a centralized logging system, but they do not natively send email alerts; additional configuration or a separate email gateway would be needed to convert syslog messages into emails.

Practice this question →

23

MCQhard

A syslog server is only reachable through a specific interface on the firewall. To ensure syslog logs are sent via that interface, which configuration is required?

A.Configure a static route for the syslog server IP

B.Set up a service route for syslog

C.Enable NAT on the syslog traffic

D.Use policy-based forwarding for syslog traffic

AnswerB

Service routes define the source interface and next-hop for management services like syslog.

Why this answer

Service routes in Palo Alto Networks firewalls allow you to specify which source interface or IP address is used for outbound traffic from the firewall itself, such as syslog, SNMP, or authentication. By configuring a service route for syslog, you ensure that syslog messages are sourced from the specific interface that can reach the syslog server, even if the routing table would otherwise choose a different path.

Exam trap

The trap here is that candidates often confuse service routes with static routes or policy-based forwarding, assuming that any routing change will fix the source interface issue, but service routes are the only mechanism that controls the source interface for firewall-originated traffic.

How to eliminate wrong answers

Option A is wrong because configuring a static route for the syslog server IP only influences the path taken by packets destined to that server, but does not control the source interface or source IP used by the firewall when sending syslog messages; the firewall may still use a different source interface based on its default route or management interface. Option C is wrong because enabling NAT on syslog traffic would translate the source IP address but does not guarantee that traffic egresses through a specific interface; NAT operates after the routing decision and does not force interface selection. Option D is wrong because policy-based forwarding (PBF) is used to override routing decisions for traffic passing through the firewall (transit traffic), not for traffic originated by the firewall itself, such as syslog logs.

Practice this question →

24

MCQeasy

A company wants to deploy a new firewall with a management interface on a separate VLAN to ensure management traffic is isolated from production traffic. Which interface type should be used for management access?

A.HA1 interface

B.VLAN interface

C.Ethernet 1/1

D.MGT (Management) interface

AnswerD

The MGT interface is a dedicated management port that can be assigned an IP on a separate VLAN for out-of-band management.

Why this answer

The MGT (Management) interface is a dedicated physical port on Palo Alto Networks firewalls designed specifically for out-of-band management traffic. It operates on a separate routing table and does not participate in production data forwarding, ensuring complete isolation of management traffic from production traffic as required by the scenario.

Exam trap

The trap here is that candidates often confuse the MGT interface with a standard data interface (like Ethernet 1/1) or a logical VLAN interface, assuming any interface can be used for management if an IP address is assigned, but the PCNSA emphasizes the need for out-of-band management isolation via the dedicated MGT port.

How to eliminate wrong answers

Option A is wrong because the HA1 interface is used exclusively for firewall high-availability control plane synchronization (heartbeat and session state), not for general management access. Option B is wrong because a VLAN interface is a logical Layer 3 interface that routes production traffic within a VLAN, and it does not provide out-of-band management isolation; using it would mix management and production traffic. Option C is wrong because Ethernet 1/1 is a standard data port that forwards production traffic and can be configured for in-band management, but it does not offer the dedicated, isolated management plane that the MGT interface provides.

Practice this question →

25

Multi-Selecteasy

Which three of the following services are commonly permitted on the management interface? (Choose three.)

Select 3 answers

B.Ping

AnswersB, C, E

Ping is commonly permitted for network reachability testing.

Why this answer

Ping (ICMP Echo) is commonly permitted on the management interface because it allows network administrators to verify the interface's reachability and responsiveness without exposing management services to unnecessary risk. While ICMP is not a management protocol per se, it is a fundamental troubleshooting tool that is typically allowed on the management plane to test connectivity to the management IP address.

Exam trap

Palo Alto Networks often tests the misconception that HTTP and Telnet are acceptable for management access because they are 'simpler' or 'legacy' protocols, but the PCNSA exam emphasizes that only encrypted protocols (HTTPS, SSH) and basic troubleshooting (ping) are permitted on the management interface.

Practice this question →

26

MCQmedium

A company uses Panorama to manage multiple firewalls. The administrator wants changes made in Panorama to be automatically pushed to managed firewalls without manual intervention. Which setting should be enabled?

A.Scheduled Config Update

B.Auto Push on Panorama

C.Schedule Commit

D.Commit on Startup

E.Auto Commit in Panorama Push Settings

AnswerE

This setting automatically pushes committed changes to managed firewalls.

Why this answer

Option E is correct because the 'Auto Commit on Panorama Push Settings' feature enables Panorama to automatically commit and push configuration changes to managed firewalls immediately after an administrator commits on Panorama, eliminating the need for manual intervention. This setting is specifically designed for automated deployment workflows where changes must be propagated without delay.

Exam trap

The trap here is that candidates confuse 'Auto Commit on Panorama Push Settings' with 'Scheduled Config Update' or 'Schedule Commit', assuming any scheduling or automation feature will suffice, but only the specific Panorama push setting provides automatic propagation upon commit.

How to eliminate wrong answers

Option A is wrong because 'Scheduled Config Update' is a feature for scheduling periodic configuration backups or updates, not for automatically pushing changes upon commit. Option B is wrong because 'Auto Push on Panorama' is not a valid setting in Panorama; the correct term is 'Auto Commit on Panorama Push Settings'. Option C is wrong because 'Schedule Commit' allows scheduling a commit operation at a specific time but does not automatically push the committed changes to managed firewalls.

Option D is wrong because 'Commit on Startup' is not a Panorama feature; it refers to a firewall boot-time behavior where the startup configuration is committed, unrelated to Panorama push automation.

Practice this question →

27

MCQmedium

Refer to the exhibit. An administrator attempts to ping the firewall's management IP (192.168.1.1) from a host on the same subnet (192.168.1.0/24) but receives no response. What is the most likely cause?

A.The host is on a different VLAN than the management subnet

B.The management interface is down

C.The firewall is in HA passive state

D.Ping is disabled on the management interface by default

AnswerD

ICMP echo replies are disabled by default for security.

Why this answer

By default, the management interface on a Palo Alto Networks firewall does not respond to ICMP echo requests (pings) unless the 'ping' service is explicitly enabled under the interface's management profile. This is a security measure to reduce the attack surface. The administrator must configure a management profile that permits ping and apply it to the management interface for ICMP responses to work.

Exam trap

The trap here is that candidates assume a firewall's management interface will respond to ping by default, similar to a router or switch, but Palo Alto Networks intentionally disables ICMP echo on the management interface to enforce least-privilege access.

How to eliminate wrong answers

Option A is wrong because the host and the management IP are on the same subnet (192.168.1.0/24), so VLAN mismatch would not affect Layer 2 connectivity within the same broadcast domain; the firewall's management interface is typically on a separate VLAN only if configured, but here the subnet is identical. Option B is wrong because if the management interface were down, the host would likely receive no ARP reply or connectivity at all, but the question states the administrator attempts to ping and receives no response, which could also occur with a functional interface that simply blocks ICMP; the interface being down is a more severe condition that would prevent any traffic, not just ping. Option C is wrong because an HA passive state does not inherently disable ICMP responses on the management interface; the passive firewall's management interface remains operational for administrative access unless specifically configured otherwise, and HA state does not affect default ping behavior.

Practice this question →

28

Multi-Selecteasy

A network administrator wants to collect and analyze traffic logs from a Palo Alto firewall. Which two methods can be used? (Choose two.)

Select 2 answers

A.Use the CLI command 'show log traffic'.

B.Use SNMP to retrieve logs.

C.Configure Panorama to collect logs.

D.Export logs to a CSV file from the GUI.

E.View logs in the Monitor tab.

AnswersC, D

Panorama acts as a central log collector.

Why this answer

Panorama is the centralized management platform for Palo Alto Networks firewalls, capable of collecting logs from multiple firewalls for aggregation, analysis, and reporting. Option C is correct because Panorama can be configured to receive traffic logs from managed firewalls, enabling centralized log collection and analysis without relying on individual firewall storage or manual export.

Exam trap

The trap here is that candidates confuse local log viewing (Monitor tab or CLI) with log collection methods, failing to recognize that 'collection' implies external aggregation or export, not just on-device display.

Practice this question →

29

MCQmedium

Refer to the exhibit. The administrator notices that traffic from 192.168.1.100 to 10.1.1.1 using HTTPS is being blocked. What is the most likely cause?

A.The source IP is not in the range.

B.The destination is in 10.0.0.0/8 but the policy is missing service TCP/443.

C.The rule is not committed.

D.The application is web-browsing, but HTTPS uses ssl application.

AnswerD

HTTPS uses ssl application, not web-browsing.

Why this answer

The exhibit shows a security policy rule that allows 'web-browsing' application traffic. HTTPS traffic uses the 'ssl' application, not 'web-browsing'. Since the rule's application match is set to 'web-browsing', it does not match HTTPS sessions, causing them to be blocked by the implicit deny rule at the end of the policy.

Exam trap

Palo Alto Networks often tests the misconception that allowing a port (TCP/443) is sufficient to permit HTTPS traffic, but in Palo Alto firewalls, the application must also be explicitly allowed in the rule.

How to eliminate wrong answers

Option A is wrong because the source IP 192.168.1.100 is within the specified source range of 192.168.1.0/24. Option B is wrong because the destination 10.1.1.1 is within 10.0.0.0/8, and the rule does include service TCP/443 (HTTPS) — the issue is the application mismatch, not a missing service. Option C is wrong because the rule is shown in the committed configuration; the problem is a logical misconfiguration, not an uncommitted change.

Practice this question →

30

MCQhard

A company has deployed a pair of PA-5250 firewalls in an Active/Passive HA configuration. The management network uses a separate subnet with addresses 10.0.0.0/24. The active firewall's management IP is 10.0.0.1, passive is 10.0.0.2. They have a virtual router configured with static routes. The HA configuration uses HA1 (backplane) for heartbeat and HA2 for session sync. After a power failure, both firewalls reboot. The active firewall comes up first and becomes active. The passive firewall later joins, but fails to become passive; it remains in 'non-functional' state. The administrator observes the following: - HA1 link is up on both firewalls. - HA2 link shows 'waiting for HA2 link' on the active. - The passive firewall's management IP is reachable. - The active firewall shows 'peer unreachable' in HA status. What is the most likely cause?

A.The management interface on the passive is misconfigured

B.The HA1 configuration is missing the peer's management IP

C.The HA2 cable is faulty or misconfigured

D.The passive firewall has a different PAN-OS version

AnswerC

HA2 being in 'waiting for HA2 link' indicates no Layer 1 connectivity.

Why this answer

The active firewall shows 'waiting for HA2 link' and 'peer unreachable' despite HA1 being up and the passive management IP being reachable. This indicates that the HA2 link, which is responsible for session synchronization and state propagation, is not functioning. Since HA2 is required for the passive firewall to transition to a passive state, a faulty or misconfigured HA2 cable prevents the passive firewall from becoming operational, leaving it in a 'non-functional' state.

Exam trap

The trap here is that candidates often confuse HA1 and HA2 roles, assuming that if HA1 is up and management is reachable, the HA pair should form, but they overlook that HA2 is mandatory for the passive firewall to exit the 'non-functional' state and become passive.

How to eliminate wrong answers

Option A is wrong because the passive firewall's management IP is reachable, which means the management interface is correctly configured and operational; a misconfigured management interface would prevent reachability. Option B is wrong because the HA1 configuration missing the peer's management IP would cause HA1 heartbeat failure, but the HA1 link is up and the active firewall shows 'peer unreachable' specifically due to HA2 issues, not HA1. Option D is wrong because a different PAN-OS version would typically cause a version mismatch error or prevent HA formation entirely, not specifically result in 'waiting for HA2 link' and 'peer unreachable' while HA1 is up.

Practice this question →

31

MCQhard

A firewall's management interface is configured with a public IP for remote management. After a firmware upgrade, HTTP access returns a 403 Forbidden error, but HTTPS works. What is the most likely cause?

A.HTTP certificate expired

B.HTTP is disabled by default after upgrade

C.Management profile HTTP permission revoked

D.Browser caching issue

E.HTTP port conflict

AnswerC

The management profile controls access; HTTP access may have been disabled during the upgrade.

Why this answer

Option C is correct because the management profile on a Palo Alto Networks firewall controls which services (HTTP, HTTPS, SSH, etc.) are allowed on each interface. After a firmware upgrade, the management profile may reset or have its HTTP permission explicitly revoked, causing HTTP access to return a 403 Forbidden error while HTTPS continues to work. The 403 error indicates the firewall is receiving the request but denying it due to policy, not a certificate or connectivity issue.

Exam trap

The trap here is that candidates often confuse a 403 Forbidden error with a certificate or connectivity problem, when in fact it indicates the firewall is actively rejecting the HTTP request due to a management profile permission being revoked.

How to eliminate wrong answers

Option A is wrong because an expired HTTP certificate would cause a browser security warning or connection failure, not a 403 Forbidden error; HTTP does not use certificates by default. Option B is wrong because HTTP is not disabled by default after a firmware upgrade; the upgrade preserves the existing management profile settings unless explicitly changed. Option D is wrong because a browser caching issue would typically cause stale content or a 404 error, not a 403 Forbidden response from the firewall itself.

Option E is wrong because an HTTP port conflict would prevent the service from starting or cause a connection refusal, not a 403 Forbidden error after the connection is established.

Practice this question →

32

MCQhard

A distributed enterprise has multiple firewalls at different sites. They want to map user IP addresses to usernames using the User-ID agent. The agent must be deployed in a way that minimizes unnecessary traffic and provides redundant coverage. What is the recommended deployment?

A.Install a single centralized User-ID agent that polls all domain controllers across sites.

B.Use the built-in User-ID agent on each firewall and point it to local domain controllers.

C.Install one User-ID agent at each site, each configured to communicate only with the local firewall.

D.Install multiple User-ID agents in a redundancy group, each serving multiple sites.

AnswerD

Correct: Reduces WAN traffic by having agents local to sites, and redundancy groups ensure continuity.

Why this answer

Option D is correct because deploying multiple User-ID agents in a redundancy group allows load balancing and failover across sites, ensuring continuous user-to-IP mapping without a single point of failure. Each agent can be configured to monitor specific domain controllers, minimizing cross-site polling traffic while providing redundant coverage. This aligns with best practices for distributed enterprises where centralized polling would create unnecessary WAN traffic and a single agent would lack resilience.

Exam trap

The trap here is that candidates often assume a single agent per site (Option C) is sufficient for redundancy, but fail to recognize that without a redundancy group, a single agent failure at a site completely breaks user mapping for that site, whereas a redundancy group provides automatic failover and load sharing.

How to eliminate wrong answers

Option A is wrong because a single centralized User-ID agent polling all domain controllers across sites would generate excessive WAN traffic and create a single point of failure, violating the requirement to minimize unnecessary traffic and provide redundancy. Option B is wrong because using the built-in User-ID agent on each firewall and pointing it to local domain controllers lacks redundancy; if a firewall fails, its local user mapping is lost, and there is no failover mechanism. Option C is wrong because installing one User-ID agent at each site configured to communicate only with the local firewall provides no redundancy; if the agent or firewall at a site fails, user mapping for that site is completely unavailable.

Practice this question →

33

MCQeasy

An administrator needs to quickly back up the device configuration to facilitate restoration after a hardware failure. Which method ensures the most reliable restoration?

A.Export the running configuration to a USB drive

B.Use the CLI command 'save named-config-snapshot' and store the file externally

C.Save the running configuration via CLI

D.Generate a tech support file

AnswerB

This creates a complete configuration snapshot for restore.

Why this answer

Option B is correct because the 'save named-config-snapshot' command creates a complete, versioned snapshot of the device's configuration that can be stored externally and restored independently of the running or startup configuration. This method ensures the most reliable restoration after hardware failure because the snapshot file is a self-contained backup that includes all configuration elements, unlike a simple running-config export which may miss dynamic or runtime-only settings.

Exam trap

The trap here is that candidates often confuse a simple configuration export (like 'copy running-config') with a true backup mechanism, not realizing that only a named-config-snapshot provides a versioned, externally storable file that can be reliably restored to a different hardware unit.

How to eliminate wrong answers

Option A is wrong because exporting the running configuration to a USB drive only saves the current active configuration, which may not include all committed changes or system-level settings, and the USB drive itself is a single point of failure. Option C is wrong because saving the running configuration via CLI (e.g., 'copy running-config startup-config') only updates the local startup configuration on the device, which is lost if the hardware fails. Option D is wrong because a tech support file is a comprehensive diagnostic dump (logs, stats, configs) intended for troubleshooting, not a clean, restore-ready configuration backup; restoring from it is unreliable and not designed for that purpose.

Practice this question →

34

MCQhard

An administrator notices repeated login failures from external IP 10.0.0.1 in the system logs. The admin wants to permanently block all traffic from that IP. Which approach is best practice?

A.Create a security policy to block the IP and commit

B.Use the admin lockout feature

C.Create a static route to null0 via CLI

D.Use a Zone Protection profile

E.Add the IP to a block list in the management profile

AnswerA

A security policy denies all traffic from that IP through the firewall.

Why this answer

Option A is correct because creating a security policy to block the IP and committing it is the standard, persistent method to block all traffic from a specific external IP address in Palo Alto Networks firewalls. This approach uses the firewall's stateful inspection engine to deny traffic at the network layer, ensuring the block survives reboots and is enforced across all interfaces.

Exam trap

The trap here is confusing management-plane controls (like admin lockout or management profile block lists) with data-plane traffic controls, leading candidates to select options that only restrict administrative access rather than blocking all traffic from the IP.

How to eliminate wrong answers

Option B is wrong because the admin lockout feature is designed to prevent administrative access to the firewall after repeated failed login attempts, not to block traffic from an external IP. Option C is wrong because creating a static route to null0 via CLI would only affect routing decisions for traffic destined to that IP, not block traffic sourced from 10.0.0.1; it also does not provide a persistent, policy-based block. Option D is wrong because Zone Protection profiles are used to mitigate flood attacks and other network-level threats, not to permanently block a specific IP address; they operate on zone-level thresholds, not individual IPs.

Option E is wrong because the block list in the management profile only restricts access to the management interface (e.g., web UI, SSH), not data-plane traffic passing through the firewall.

Practice this question →

35

MCQmedium

A network administrator recently changed the admin password on a Palo Alto Networks firewall and logged out. The next day, the administrator attempts to log in via SSH but receives 'access denied' after three attempts. The administrator typically uses SSH from a management workstation. The firewall's management interface is still reachable via ping. The administrator suspects the account may be locked due to failed attempts. Since the administrator is not currently logged in, there is no way to unlock the account remotely. The administrator has physical access to the data center and can connect a laptop to the console port. What is the most efficient way to regain administrative access to the firewall?

A.Reboot the firewall and interrupt the boot process to reset the admin password.

B.Factory reset the firewall and restore the configuration from a backup.

C.Use the 'debug' command in the management interface to bypass the lockout.

D.Connect via the serial console and use the maintenance mode to reset the admin password.

AnswerD

This is the official password recovery procedure.

Why this answer

Option D is correct because the Palo Alto Networks firewall's serial console provides access to a maintenance mode that allows the administrator to reset the local admin password without needing to log in. This is the most efficient method when the account is locked due to failed SSH attempts and physical access is available, as it avoids a full reboot or factory reset.

Exam trap

The trap here is that candidates may confuse Palo Alto Networks' password recovery method with Cisco IOS's ROMMON password recovery, leading them to incorrectly select Option A (reboot and interrupt boot process) instead of the correct serial console maintenance mode approach.

How to eliminate wrong answers

Option A is wrong because rebooting and interrupting the boot process does not provide a mechanism to reset the admin password on a Palo Alto Networks firewall; this is a common misconception from other platforms like Cisco IOS. Option B is wrong because a factory reset would erase the entire configuration, requiring a backup restore, which is far less efficient and unnecessary when only the admin password needs to be reset. Option C is wrong because the 'debug' command is not available on the management interface for bypassing account lockouts; account lockout is enforced by the local authentication system and cannot be overridden via debug commands.

Practice this question →

36

MCQeasy

An administrator wants to synchronize the firewall's clock with a central NTP server. Where is this configured?

A.Under Objects > Regions

B.Under Device > Setup > Services, NTP tab

C.Under Device > Licenses

D.Under Network > Interfaces, Management Interface

AnswerB

NTP configuration is located under Device > Setup > Services in the NTP tab.

Why this answer

Option B is correct because NTP (Network Time Protocol) client configuration on a Palo Alto Networks firewall is performed under Device > Setup > Services, where the NTP tab allows you to specify primary and secondary NTP servers. This synchronizes the firewall's system clock, which is critical for accurate log timestamps, certificate validation, and security policy enforcement. The firewall acts as an NTP client, sending periodic NTP requests (typically using UDP port 123) to the configured servers.

Exam trap

The trap here is that candidates often confuse the management interface IP configuration (Network > Interfaces) with NTP settings, or they mistakenly think NTP is part of license management or object definitions, but Palo Alto Networks specifically places NTP under Device > Setup > Services to separate network-layer settings from system services.

How to eliminate wrong answers

Option A is wrong because Objects > Regions is used to define geographic regions for policy-based filtering (e.g., blocking traffic from specific countries), not for clock synchronization. Option C is wrong because Device > Licenses is where you manage subscription licenses (e.g., Threat Prevention, URL Filtering) and activate the firewall, not for NTP configuration. Option D is wrong because Network > Interfaces, Management Interface is used to configure the dedicated management port (MGT) IP address, default gateway, and DNS settings, but NTP server configuration is a separate service setting under Device > Setup > Services.

Practice this question →

37

MCQmedium

Refer to the exhibit. A firewall has the configuration shown. A security policy allows traffic from the internal zone to the external zone. However, users on the internal network (192.168.1.0/24) cannot reach the internet. What is the most likely cause?

A.The internal interface has no IP address assigned

B.The internal zone is not configured

C.The default route is missing

D.The internal interface (ethernet1/2) is administratively down

AnswerD

The interface must be up for traffic to pass.

Why this answer

Option D is correct because the exhibit shows that ethernet1/2, which is the internal interface, is administratively down (status 'admin down'). An administratively down interface does not pass any traffic, regardless of security policies or routing. Even with a correct security policy allowing internal-to-external traffic, the interface must be operationally up for packets to enter or leave the firewall.

Exam trap

The trap here is that candidates often overlook the interface administrative state and instead focus on routing or security policy misconfigurations, assuming that a configured IP and zone guarantee traffic flow.

How to eliminate wrong answers

Option A is wrong because the exhibit shows the internal interface (ethernet1/2) has an IP address of 192.168.1.1/24 assigned, so an IP address is present. Option B is wrong because the exhibit shows the internal zone is configured and assigned to ethernet1/2 (zone 'internal' is listed). Option C is wrong because while a missing default route could prevent internet access, the exhibit does not show routing configuration, and the immediate symptom of an administratively down interface is a more direct and likely cause; a missing default route would still allow local traffic, but here no traffic passes at all.

Practice this question →

38

MCQhard

Refer to the exhibit. What does this log indicate?

A.A file transfer was blocked.

B.An intrusion was detected and allowed.

C.A URL filtering event occurred.

D.An intrusion was detected and dropped.

AnswerD

Threat log with action drop indicates intrusion dropped.

Why this answer

The log shows a threat ID (e.g., 12345) with a severity of 'critical' and an action of 'drop' or 'block', indicating that the firewall detected an intrusion attempt and dropped the packet. Option D is correct because the log specifically records an intrusion prevention system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.

Exam trap

Palo Alto Networks often tests the distinction between 'allowed' and 'dropped' actions in threat logs, where candidates mistakenly assume that any detected intrusion is automatically dropped, but the action field must be explicitly checked to confirm the firewall's response.

How to eliminate wrong answers

Option A is wrong because a file transfer block would be logged as a 'file-block' or 'virus' event under the threat or data filtering category, not as an intrusion signature match. Option B is wrong because an intrusion that is allowed would show an action of 'allow' or 'alert' in the log, not 'drop' or 'block'. Option C is wrong because a URL filtering event would be logged under the URL filtering category with a URL category and action like 'block-override', not under the threat log with a vulnerability signature ID.

Practice this question →

39

MCQmedium

A Panorama-managed firewall currently allows SSH access from any IP. The security policy requires that administrative access to the firewall be possible only from Panorama. What should be configured?

A.Configure the management interface to accept connections only from the Panorama IP address.

B.Disable SSH and HTTP on the firewall.

C.Remove all local admin accounts.

D.Set 'Managed by Panorama' to enable.

AnswerA

This restricts management access to the Panorama IP, fulfilling the requirement.

Why this answer

Option A is correct because the requirement is to restrict administrative access to the firewall exclusively from Panorama. By configuring the management interface to accept connections only from the Panorama IP address, you create a source IP-based access control that blocks SSH (and other management protocols) from any other IP. This directly enforces the security policy while still allowing Panorama to manage the firewall.

Exam trap

The trap here is that candidates often confuse 'Managed by Panorama' (which only enables the firewall to connect to Panorama for configuration pushes) with a security control that restricts inbound management access, when in fact it does nothing to block SSH from other sources.

How to eliminate wrong answers

Option B is wrong because disabling SSH and HTTP on the firewall would block all administrative access, including from Panorama, which violates the requirement that Panorama must still be able to manage the device. Option C is wrong because removing all local admin accounts does not restrict network-level access; SSH would still be reachable from any IP, and Panorama would lose the ability to authenticate for management. Option D is wrong because setting 'Managed by Panorama' to enable only establishes the management connection from the firewall to Panorama; it does not restrict inbound SSH access from other IPs, leaving the firewall vulnerable to unauthorized administrative connections.

Practice this question →

40

MCQhard

A company uses Panorama to manage multiple device groups. They want to push a set of global security policies to all firewalls. Where should the administrator configure these policies in Panorama?

A.As pre-rules in the 'shared' device group

B.As pre-rules in each regional device group

C.In the default rule base of each device group

D.As post-rules in the 'shared' device group

AnswerA

Pre-rules in shared are pushed to all firewalls first.

Why this answer

In Panorama, the 'shared' device group is designed for policies that must apply globally across all managed firewalls. Configuring security policies as pre-rules in the shared device group ensures they are evaluated before any device-group-specific rules, providing a consistent global baseline that cannot be overridden by local rules.

Exam trap

The trap here is that candidates often confuse 'shared' with 'post-rules', mistakenly thinking post-rules are the correct location for global policies, but post-rules are evaluated last and can be overridden by device-group rules.

How to eliminate wrong answers

Option B is wrong because pre-rules in each regional device group would only apply to firewalls within that specific group, not globally across all device groups. Option C is wrong because the default rule base of each device group is local to that group and does not provide a single, centralized location for global policies. Option D is wrong because post-rules in the shared device group are evaluated after device-group rules, which would allow local policies to override the global intent, defeating the purpose of a global security baseline.

Practice this question →

41

MCQeasy

A network admin needs to push a security policy change to firewall-01 and firewall-02. Both firewalls have different interface configurations but should share the same security rules. What is the best way to achieve this using Panorama?

A.Create separate device groups for each firewall and configure identical policies manually.

B.Create a single device group containing both firewalls and configure security policies there.

C.Use templates to define security policies and assign to both firewalls.

D.Use the Shared policy and override for interfaces.

AnswerB

Correct: Device groups allow shared policy configuration while templates handle interface differences.

Why this answer

Option A is correct because Panorama device groups are designed to share policies across firewalls, while templates handle device-specific settings. Option B (separate groups) duplicates effort; Option C (templates) is wrong because templates are for device configuration, not security policy; Option D (Shared policy with overrides) is not a standard approach for policy sharing.

Practice this question →

42

MCQmedium

A security administrator notices that a security policy rule is not matching traffic that should be allowed. The rule specifies source address as 10.0.1.0/24, destination address as 192.168.2.0/24, and application 'web-browsing'. The traffic originates from 10.0.1.5 to 192.168.2.10 using HTTPS. The traffic log shows that another rule with higher priority is matching and denying the traffic. What should the administrator check first?

A.Ensure that logging is enabled on the rule

B.Review the application specified in the rule and the actual traffic

C.Check the zone configuration for the destination

D.Verify that the source and destination IP ranges are correct

AnswerB

The rule uses 'web-browsing' but traffic is HTTPS (ssl), so the rule does not match.

Why this answer

The rule specifies application 'web-browsing', which typically matches HTTP (TCP/80) traffic, but the actual traffic is HTTPS (TCP/443). In Palo Alto Networks firewalls, application identification is based on the App-ID engine, which inspects traffic beyond the port; 'web-browsing' does not match HTTPS unless explicitly configured. Therefore, the administrator should first review the application specified in the rule versus the actual traffic to understand why the rule is not matching.

Exam trap

The trap here is that candidates assume IP addresses or zones are the issue, but Palo Alto Networks firewalls prioritize application identification over port numbers, so a rule with 'web-browsing' will not match HTTPS traffic even if all other conditions are satisfied.

How to eliminate wrong answers

Option A is wrong because logging is a reporting feature, not a cause of rule matching failure; enabling logging would only record the match or miss, not fix the mismatch. Option C is wrong because zone configuration affects traffic flow and rule application, but the question states another rule with higher priority is matching and denying the traffic, indicating zones are correctly assigned for that rule; the issue is application mismatch, not zones. Option D is wrong because the source and destination IP ranges (10.0.1.0/24 and 192.168.2.0/24) are correct for the traffic (10.0.1.5 and 192.168.2.10), so verifying them would not resolve the application mismatch.

Practice this question →

43

MCQmedium

A network administrator needs to restrict which source IP addresses can access the firewall's web management interface. Which feature should be configured?

A.Management Profile

B.Access Control List on the data plane

C.Interface management settings

D.Security policy rule for management traffic

AnswerA

Management Profiles define allowed source IPs and services for management access.

Why this answer

The correct answer is A, Management Profile. A Management Profile is a firewall configuration object that defines which services (e.g., HTTPS, SSH, ping) are allowed on a specific interface and, critically, which source IP addresses or subnets can access those services. By binding a Management Profile to an interface, the administrator can restrict web management access to only trusted source IPs, such as a management subnet.

This is the intended and most secure method for controlling management plane access on Palo Alto Networks firewalls.

Exam trap

The trap here is that candidates often confuse data plane security policies (which control traffic through the firewall) with management plane access controls, leading them to select Option D or Option B, when in fact the Management Profile is the dedicated feature for restricting source IPs to the firewall's own management services.

How to eliminate wrong answers

Option B is wrong because an Access Control List (ACL) on the data plane controls traffic passing through the firewall (e.g., between zones), not traffic destined to the firewall itself (management plane traffic). Option C is wrong because Interface Management Settings is a generic term; the specific feature that includes source IP restriction is the Management Profile, not a separate setting. Option D is wrong because a Security Policy Rule for management traffic would apply to transit traffic and is not designed to filter management plane access to the firewall's own interfaces; management traffic is handled by the management plane, not the data plane security policy.

Practice this question →

44

Multi-Selectmedium

Which two authentication methods can be used for administrative access to the firewall's web interface? (Choose two.)

Select 2 answers

A.SAML

B.NTLM

C.OAuth

D.Local database

E.Kerberos

AnswersA, D

SAML is supported for single sign-on to the web interface.

Why this answer

SAML (Security Assertion Markup Language) is correct because it enables single sign-on (SSO) for administrative access to the firewall's web interface, allowing integration with external identity providers (IdPs) such as Okta or Azure AD. The local database is correct because it is the default authentication method, where administrators are created and stored locally on the firewall, and credentials are verified against the internal user database. Both methods are natively supported in PAN-OS for web interface (GUI) access.

Exam trap

Palo Alto Networks often tests the misconception that any common enterprise authentication protocol (like NTLM or Kerberos) is automatically supported for administrative access, but Palo Alto firewalls specifically support only SAML, local database, RADIUS, LDAP, and TACACS+ for web interface authentication.

Practice this question →

45

MCQeasy

A firewall uses an external SMTP server for email alerts. The SMTP server is reachable via a specific virtual router and interface. What must be configured to ensure the firewall uses the correct path to reach the SMTP server?

A.Ensure the SMTP server is in the same zone as the management interface.

B.Configure an SNMP trap destination.

C.Configure a service route for SMTP.

D.Add a static route for the SMTP server.

AnswerC

Correct: Service routes define the source interface and IP used by management services like SMTP.

Why this answer

Option C is correct because service routes in Palo Alto Networks firewalls explicitly define the source interface and virtual router used for outbound management traffic, such as SMTP email alerts. By configuring a service route for SMTP, the firewall ensures that email alerts are sent via the specified virtual router and interface, overriding the default management plane routing behavior.

Exam trap

The trap here is that candidates often assume a static route is sufficient, but without a service route, the firewall's management plane will use the default management interface and its associated routing table, which may not have a path to the SMTP server.

How to eliminate wrong answers

Option A is wrong because the SMTP server does not need to be in the same zone as the management interface; service routes decouple management traffic from security zones. Option B is wrong because SNMP trap destinations are used for SNMP notifications, not for SMTP email alerts. Option D is wrong because while a static route could influence routing, it does not control which source interface or virtual router the firewall uses for management traffic; service routes are required to bind the SMTP service to a specific path.

Practice this question →

46

MCQmedium

After making configuration changes, an administrator clicks 'Commit' but the changes are not applied. What is the most likely cause?

A.Configuration validation errors exist

B.The commit is scheduled for a later time

C.The commit was canceled by another admin

D.The firewall is in multi-vsys mode and only the current vsys is committed

AnswerA

If there are validation errors, the commit will not proceed until errors are resolved.

Why this answer

When an administrator clicks 'Commit' but the changes are not applied, the most likely cause is that configuration validation errors exist. The Palo Alto Networks firewall performs a validation check before committing; if any errors are found (e.g., invalid IP addresses, missing required fields, or conflicting rules), the commit is blocked and an error message is displayed. This ensures that only syntactically and semantically correct configurations are applied to the running state.

Exam trap

The trap here is that candidates may assume a commit always succeeds if no syntax errors are shown in the GUI, but PAN-OS performs deep validation that can catch semantic issues (e.g., referencing a non-existent security profile) that prevent the commit from completing.

How to eliminate wrong answers

Option B is wrong because a scheduled commit would still be applied at the specified time, not silently ignored; the administrator would see a confirmation that the commit is pending. Option C is wrong because if another admin cancels a commit, the administrator would receive a notification or error message indicating the cancellation, not a silent failure. Option D is wrong because in multi-vsys mode, committing only the current vsys is a normal operation and would still apply changes to that vsys; the commit would not fail silently unless there were validation errors in that vsys's configuration.

Practice this question →

47

MCQhard

A company uses Panorama to manage multiple firewalls. After pushing a template change, one firewall fails to commit with error 'invalid certificate path'. What is the most likely cause?

A.The firewall's management IP changed

B.Template commit requires reconnection

C.The template includes a certificate that has no trusted root on that firewall

D.The firewall's certificate has expired

E.Panorama's certificate is mismatched

AnswerC

The certificate chain is incomplete; need to install the root CA.

Why this answer

Option C is correct because when a template push includes a certificate (e.g., for SSL decryption or authentication) that references a Certificate Authority (CA) not trusted by the target firewall, the commit fails with 'invalid certificate path'. The firewall cannot validate the certificate chain because the root or intermediate CA certificate is missing from its trusted store, causing the commit to abort.

Exam trap

The trap here is that candidates often confuse certificate expiration (Option D) with a missing trusted root, but the specific error 'invalid certificate path' points to a chain validation issue, not a time-based expiry.

How to eliminate wrong answers

Option A is wrong because a change in the firewall's management IP would cause connectivity loss, not a commit error related to certificate validation. Option B is wrong because template commits do not require a reconnection; Panorama pushes configurations to firewalls over the existing management connection, and a reconnection is not a prerequisite for commit. Option D is wrong because an expired certificate on the firewall would generate a different error (e.g., 'certificate expired') and would not specifically reference an 'invalid certificate path'.

Option E is wrong because a mismatched Panorama certificate would cause authentication or communication failures between Panorama and the firewall, not a commit failure on the firewall itself with a certificate path error.

Practice this question →

48

Multi-Selectmedium

An organization is implementing a high availability pair of Palo Alto firewalls in active/passive mode. Which three actions are necessary for proper failover functionality? (Choose three.)

Select 3 answers

A.Set the firewall priority to determine the active role.

B.Enable session synchronization.

C.Assign the same IP address to both firewalls for the data interface.

D.Sync the running configuration to the passive firewall.

E.Configure the HA interface IP addresses.

AnswersA, B, E

Priority determines which firewall becomes active.

Why this answer

Option A is correct because in an active/passive HA pair, the firewall priority (1-100, lower is higher priority) determines which firewall assumes the active role. The firewall with the numerically lower priority value becomes the active unit, ensuring deterministic failover behavior.

Exam trap

The trap here is that candidates often confuse configuration synchronization (which is automatic) with a manual step, or mistakenly think both firewalls can share the same data interface IP address, not realizing that only the active firewall uses the floating IP while each unit has its own unique management and interface IPs.

Practice this question →

49

MCQhard

An administrator is tasked with centralizing the management of 50 Palo Alto firewalls spread across four geographical regions. The company has a Panorama VM deployed in the data center. Each firewall must receive a common set of security policies and URL filtering profiles, but regional administrators need the ability to add locally required policies. The administrator configures Panorama with device groups: 'Shared' device group for global policies, and four regional device groups (Americas, EMEA, APAC, Oceania). They create a template for basic network settings and use template stacks. After pushing the Device Group and Template configuration, some regional firewalls report that they are not receiving the shared policies. What is the most likely cause?

A.The firewalls are not connected to Panorama due to management IP misconfiguration

B.The 'Shared' device group is not included in the device group hierarchy for the regional device groups

C.Regional administrators created local policies in their own device groups with higher order than shared policies

D.The template stack does not include the shared template

AnswerB

Without inheritance configuration, shared policies are not applied.

Why this answer

The 'Shared' device group is automatically included in the device group hierarchy for all firewalls managed by Panorama, but only if the regional device groups are configured as children of the 'Shared' group. If the regional device groups are created as top-level groups instead of being nested under 'Shared', the firewalls assigned to those regional groups will not inherit the shared policies. This is the most likely cause because the shared policies are not being pushed to the firewalls due to a missing hierarchy relationship.

Exam trap

The trap here is that candidates assume the 'Shared' device group is automatically inherited by all firewalls regardless of device group hierarchy, but Panorama requires explicit nesting of device groups under 'Shared' for policy inheritance to occur.

How to eliminate wrong answers

Option A is wrong because if the firewalls were not connected to Panorama due to management IP misconfiguration, they would not report any configuration push status at all, and the issue would affect all policies, not just shared ones. Option C is wrong because local policies in regional device groups with higher order (lower precedence) would override shared policies only if they conflict, but the question states that shared policies are not being received at all, which indicates a hierarchy or inheritance issue, not a rule order conflict. Option D is wrong because the template stack is used for network settings, not security policies; the 'Shared' device group is a device group concept, not a template, and templates do not affect policy inheritance.

Practice this question →

50

Multi-Selectmedium

A security analyst wants to send firewall logs to an external syslog server for long-term storage. Which three configuration steps are necessary?

Select 3 answers

A.Apply the log forwarding profile to a security policy rule.

B.Enable the syslog server in the Device > Server Profiles menu.

C.Set the syslog server to use TCP port 514.

D.Configure a log forwarding profile with syslog as the destination.

E.Specify the syslog facility code in the log forwarding profile.

AnswersA, B, D

The profile must be applied to a rule to generate logs.

Why this answer

Option A is correct because a log forwarding profile must be applied to a security policy rule to specify which traffic logs should be forwarded to the external syslog server. Without this association, the firewall will not send the logs generated by that rule to the syslog destination.

Exam trap

The trap here is that candidates assume TCP port 514 is the default or required for syslog, but Palo Alto firewalls use UDP 514 by default, and changing to TCP is an optional optimization, not a necessary step.

Practice this question →

51

MCQeasy

A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?

A.Create local accounts for all engineers and sync with AD manually.

B.Use Kerberos authentication only.

C.Configure only RADIUS authentication and disable local authentication.

D.Enable local authentication and configure RADIUS as the primary authentication method with local fallback.

AnswerD

Correct: This allows AD authentication while local admin account remains available for fallback.

Why this answer

Option D is correct because it allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.

Exam trap

The trap here is that candidates often assume Kerberos or LDAP is the only way to integrate with Active Directory, or they mistakenly think that disabling local authentication is acceptable, overlooking the critical requirement for emergency access when the external authentication server is unavailable.

How to eliminate wrong answers

Option A is wrong because creating local accounts for all engineers and manually syncing with AD defeats the purpose of centralized authentication, introduces administrative overhead, and does not leverage existing AD credentials. Option B is wrong because using Kerberos authentication only is not directly supported on Palo Alto Networks firewalls for admin authentication; the firewall relies on RADIUS or LDAP for AD integration, and Kerberos alone cannot provide the required fallback to local accounts. Option C is wrong because configuring only RADIUS authentication and disabling local authentication removes the ability to log in with a local admin account during a RADIUS server outage, violating the requirement for emergency access.

Practice this question →

52

Multi-Selectmedium

A network administrator needs to ensure that firewall-generated traffic (e.g., NTP queries, DNS lookups, Panorama communications) uses a specific source IP address from a loopback interface. Which two configuration steps are required? (Choose two.)

Select 2 answers

A.Define a static route on the firewall directing traffic to the loopback.

B.Create a service route configuration for each service type.

C.Set the source IP for each service under Device > Setup > Services > Service Route Configuration.

D.Configure the management interface IP as the source for all services.

E.Enable 'Use Loopback as Source' under Network > Interfaces > Loopback.

AnswersB, C

Service routes are required to override the default source interface for services.

Why this answer

Option B is correct because service routes allow you to specify which source IP address the firewall uses for traffic it generates itself, such as NTP, DNS, and Panorama communications. Option C is correct because the actual configuration is performed under Device > Setup > Services > Service Route Configuration, where you can assign a specific source IP (e.g., from a loopback interface) for each service type. This ensures that firewall-originated traffic uses a consistent, routable source address independent of the egress interface.

Exam trap

The trap here is that candidates confuse service routes with interface-level settings or static routes, mistakenly thinking they need to configure a route to the loopback or enable a toggle on the loopback interface itself, rather than using the dedicated service route configuration under Device Setup.

Practice this question →

53

MCQeasy

An administrator upgrades a firewall from PAN-OS 9.1 to 10.0, but a subsequent commit fails. Which log should the administrator examine first to find the cause of the failure?

A.System log

B.Config log

C.Traffic log

D.Threat log

AnswerB

Config log contains commit results and configuration errors.

Why this answer

When a commit fails after an upgrade, the system log records commit failures with specific error codes and messages. The administrator should examine the system log first because it captures the commit process details, including configuration validation errors, dependency issues, or incompatible settings introduced by the PAN-OS version change. The config log records configuration changes but does not provide the real-time commit failure diagnostics needed to identify the root cause.

Exam trap

The trap here is that candidates often confuse the config log (which records configuration changes) with the system log (which records operational events like commit failures), leading them to incorrectly select the config log as the first place to look for commit failure causes.

How to eliminate wrong answers

Option A is wrong because the system log is the primary source for commit failure details, not the config log. Option C is wrong because the traffic log records network traffic flows and security policy matches, not commit or configuration errors. Option D is wrong because the threat log captures security threats such as intrusions, viruses, and spyware, and is unrelated to configuration commit failures.

Practice this question →

54

MCQhard

After a firewall upgrade, the system clock shows a time that is five minutes behind the actual time, even though NTP is synchronized. What is the most likely cause?

A.The firewall is using a stratum 2 server that is inaccurate.

B.The timezone offset is incorrectly set.

C.NTP authentication is not configured.

D.The NTP admin state is enabled but the service route is misconfigured.

AnswerB

A wrong timezone would cause the displayed local time to differ from UTC, even if NTP is synced.

Why this answer

When NTP is synchronized but the system clock is offset by a fixed amount (e.g., five minutes), the most likely cause is an incorrect timezone offset. NTP synchronizes the UTC time, and the firewall then applies the configured timezone offset to display the local time. If the offset is wrong, the displayed time will be consistently off by that offset value, even though NTP shows synchronization.

Exam trap

The trap here is that candidates often assume NTP synchronization guarantees correct local time, but they overlook that the timezone offset must be independently configured; Cisco tests this by presenting a scenario where NTP is synchronized yet the displayed time is wrong, leading to confusion between NTP server issues and timezone configuration errors.

How to eliminate wrong answers

Option A is wrong because a stratum 2 server that is inaccurate would cause the clock to drift or show a varying offset, not a consistent five-minute offset, and NTP would likely show the server as unsynchronized or with high jitter. Option C is wrong because NTP authentication is used to verify the identity of NTP servers, not to correct time offset; its absence does not cause a fixed time difference. Option D is wrong because if the NTP admin state is enabled but the service route is misconfigured, the firewall would not be able to reach the NTP server at all, resulting in no synchronization, not a synchronized clock with a fixed offset.

Practice this question →

55

MCQhard

After enabling password complexity on a Palo Alto firewall, an administrator is unable to access the management web interface remotely. The administrator can still access the console locally. What is the most likely cause?

A.Password complexity automatically disables HTTPS management.

B.The administrator's account is locked due to too many failed login attempts.

C.The password does not meet the new complexity requirements, causing the commit to fail and revert the management configuration.

D.HTTPS management is automatically disabled when password complexity is enabled.

AnswerC

A commit failure could revert changes, but more likely the account is locked; however, the commit failure scenario is plausible. Actually, the most likely cause is that the administrator changed the password via console but the new password did not meet complexity, so the change was rejected, and the remote session used the old password which might have been cached? Another scenario: The complexity policy might require a password change on next login, but the remote session fails because the password needs to be changed. However, the best answer is that the complexity policy may have triggered a forced change, but the remote session doesn't initiate the change, so access is denied. But option C is the best among the given.

Why this answer

Option C is correct because when password complexity is enabled on a Palo Alto firewall, the administrator must ensure the existing password meets the new complexity requirements before committing the change. If the current password does not satisfy the new rules, the commit will fail and the management configuration (including HTTPS access) will revert to its previous state, effectively blocking remote web access while local console access remains available.

Exam trap

The trap here is that candidates often assume password complexity only affects future password changes, not the current password, and overlook the commit failure and configuration rollback that can disable remote management access.

How to eliminate wrong answers

Option A is wrong because enabling password complexity does not automatically disable HTTPS management; HTTPS management is controlled separately under Device > Setup > Management. Option B is wrong because the scenario states the administrator can still access the console locally, which would not be possible if the account were locked (a locked account prevents all access methods, including console). Option D is wrong because there is no automatic disabling of HTTPS management when password complexity is enabled; the two features are independent and HTTPS management remains enabled unless explicitly turned off.

Practice this question →

56

Multi-Selecthard

Which THREE log types can be forwarded to a syslog server?

Select 3 answers

A.Packet capture logs

B.Threat logs

C.Configuration logs

D.Traffic logs

E.System logs

AnswersB, D, E

Threat logs can be forwarded to syslog.

Why this answer

B is correct because threat logs capture security-related events such as intrusion attempts, malware detection, and vulnerability exploits, which are critical for security monitoring. The Palo Alto Networks firewall can forward these logs to a syslog server (e.g., using UDP 514 or TCP 6514) for centralized analysis and alerting. This is a standard feature in PAN-OS for integrating with SIEM systems.

Exam trap

The trap here is that candidates often confuse 'packet capture logs' with 'traffic logs' or assume all log types are syslog-forwardable, but PAN-OS restricts syslog forwarding to specific log types (threat, traffic, system) by default, while packet captures and configuration logs require separate handling.

Practice this question →

57

MCQeasy

What is the purpose of the 'Telemetry' feature in PAN-OS?

A.To send anonymous device health and usage data to Palo Alto Networks

B.To send logs to Panorama

C.To enable DNS proxy

D.To configure User-ID agent

AnswerA

Telemetry shares non-identifying operational data to help improve PAN-OS.

Why this answer

The Telemetry feature in PAN-OS sends anonymous device health and usage data to Palo Alto Networks to help improve product development and threat detection. This data includes information such as system resource utilization, feature usage statistics, and aggregate threat information, but does not include sensitive or personally identifiable information. It is an opt-in feature that enhances Palo Alto Networks' ability to provide proactive support and security updates.

Exam trap

The trap here is that candidates often confuse Telemetry with log forwarding or Panorama integration, assuming it is used for centralized management or log collection, when in fact it is solely for anonymous data sharing to improve Palo Alto Networks' services.

How to eliminate wrong answers

Option B is wrong because sending logs to Panorama is the function of log forwarding or the Panorama integration, not the Telemetry feature. Option C is wrong because enabling DNS proxy is a separate network service configuration, unrelated to Telemetry. Option D is wrong because configuring User-ID agent is a distinct identity management function, not part of Telemetry.

Practice this question →

58

Multi-Selecthard

Which THREE of the following are valid steps when configuring a new virtual wire (vwire) on a Palo Alto Networks firewall?

Select 3 answers

A.Add two or more interfaces as members of the virtual wire

B.Assign an IP address to the virtual wire

C.Commit the configuration

D.Create a security policy allowing traffic on the virtual wire

E.Create a virtual wire object under Network > Virtual Wires

AnswersA, C, E

Interfaces are added as members of the vwire.

Why this answer

Option A is correct because a virtual wire requires at least two interfaces to be added as members, which allows the firewall to transparently bridge traffic between them without any IP configuration. The virtual wire acts as a Layer 2 bump-in-the-wire, so interfaces are placed into the vwire to forward frames based on MAC addresses, not IP routing.

Exam trap

The trap here is that candidates confuse the need for an IP address on a virtual wire (which is Layer 2) with the requirement for IP addresses on Layer 3 interfaces, leading them to incorrectly select option B as a valid step.

Practice this question →

59

MCQeasy

An administrator needs to check the system uptime of the firewall. Which CLI command should be used?

A.show uptime

B.show system state

C.show system info

D.show system resources

AnswerC

Displays uptime among other system information.

Why this answer

The 'show system info' command on Palo Alto Networks firewalls displays system information including the system uptime, model, software version, and serial number. This is the correct command to check the firewall's uptime as it directly provides the time since the last reboot.

Exam trap

The trap here is that candidates may confuse the generic Linux 'uptime' command with the Palo Alto-specific syntax, or assume 'show system state' or 'show system resources' would include uptime, but only 'show system info' provides the exact uptime value.

How to eliminate wrong answers

Option A is wrong because 'show uptime' is not a valid CLI command on Palo Alto Networks firewalls; the correct command to view uptime is 'show system info'. Option B is wrong because 'show system state' displays the current operational state of various system components, not the system uptime. Option D is wrong because 'show system resources' shows CPU, memory, and disk utilization, not the system uptime.

Practice this question →

60

MCQeasy

A network administrator wants to allow FTP traffic from the internal network to a specific external server. The administrator creates a security policy rule with source zone 'internal', destination zone 'external', destination IP of the server, and application 'ftp'. However, the traffic is still blocked. What is the most likely reason?

A.The destination IP is not covered by a NAT policy

B.Logging is not enabled on the rule

C.The rule is set to deny instead of allow

D.The FTP application requires additional configuration for passive mode

AnswerD

FTP uses dynamic ports; the firewall needs to inspect control channel to allow data channel.

Why this answer

FTP uses two separate channels: a control channel (TCP 21) and a data channel. In passive mode, the client initiates both connections, but the data channel uses a random high port negotiated via the control channel. The Palo Alto Networks firewall's application decoder for FTP must inspect the control channel to dynamically open pinholes for the data channel; without this, the data connection is blocked even if the control channel is allowed.

Option D is correct because the administrator likely created a rule for application 'ftp' but did not ensure that the FTP application's passive mode data connections are properly handled, which requires the firewall to perform application-level inspection and create temporary security policy openings for the negotiated data ports.

Exam trap

The trap here is that candidates assume a simple 'allow' rule for the application 'ftp' is sufficient, overlooking that FTP's dual-channel nature requires the firewall to perform deep packet inspection to dynamically permit the data channel ports negotiated in passive mode.

How to eliminate wrong answers

Option A is wrong because NAT policy is not required for outbound traffic to an external server unless the destination IP is a private address; the question specifies the destination IP is that of the external server, so NAT is irrelevant to blocking the traffic. Option B is wrong because logging is a monitoring feature that does not affect whether traffic is permitted or denied; a rule without logging still allows or blocks traffic based on its action. Option C is wrong because the question states the administrator created a security policy rule with the intent to allow traffic; if the rule were set to deny, the traffic would be blocked for that reason, but the most likely reason given the specific application 'ftp' is the passive mode data channel issue, not a simple action misconfiguration.

Practice this question →

61

MCQeasy

During troubleshooting, an administrator needs to review firewall system events such as user logins, configuration changes, and commit failures. Which log type should be examined?

A.Threat logs

B.Traffic logs

C.System logs

D.URL filtering logs

AnswerC

System logs record administrative activities and system events.

Why this answer

System logs in Palo Alto Networks firewalls capture administrative and system-level events, including user logins, configuration changes, and commit failures. These logs are generated by the management plane and are essential for auditing and troubleshooting device management activities.

Exam trap

The trap here is that candidates often confuse system logs with traffic logs, assuming all firewall events are recorded in traffic logs, but system logs are specifically for management-plane events like user logins and commits.

How to eliminate wrong answers

Option A is wrong because Threat logs record security threats such as intrusions, malware, and spyware detected by the firewall, not administrative or system events. Option B is wrong because Traffic logs contain session-level details about allowed or denied network flows, not user logins or configuration changes. Option D is wrong because URL filtering logs track web requests and categorization results, not system-level administrative actions.

Practice this question →

62

MCQmedium

An administrator wants to ensure that a specific security policy rule is applied before all other rules. What should be configured?

A.Set the rule's priority to 1

B.Use a schedule

C.Move the rule to the top of the rulebase

D.Enable 'Optimize' on the rule

AnswerC

Top-down evaluation means top rule is evaluated first.

Why this answer

In Palo Alto Networks firewalls, security policy rules are evaluated in a top-down order, and the first matching rule is applied. Moving a rule to the top of the rulebase ensures it is evaluated before all other rules, guaranteeing it takes precedence regardless of its priority number. Priority numbers (1-65535) are used for ordering within the rulebase, but the physical position in the list determines evaluation order; setting priority to 1 does not automatically place the rule at the top if other rules with lower numbers exist.

Exam trap

The trap here is that candidates confuse the 'priority' field with physical rule order, assuming a lower priority number automatically places the rule at the top, when in fact the rule must be physically moved to the top of the rulebase to ensure it is evaluated first.

How to eliminate wrong answers

Option A is wrong because setting the rule's priority to 1 only assigns a numerical value for ordering, but the actual evaluation order is determined by the rule's position in the rulebase; a rule with priority 1 can still be placed below other rules if not physically moved to the top. Option B is wrong because a schedule controls when a rule is active (time-based enforcement), not its evaluation order relative to other rules. Option D is wrong because 'Optimize' is not a valid configuration option on security rules in Palo Alto Networks; it is a feature for rulebase optimization in Panorama, not for ordering rules.

Practice this question →

63

MCQhard

An administrator notices that the firewall's web interface is accessible via HTTPS but shows an expired certificate warning. The firewall's management certificate was issued by an internal CA and has a validity of two years. The administrator checks the certificate and sees it expired yesterday. The administrator generates a new self-signed certificate through the firewall's GUI. After generating, the administrator assigns the new certificate to the HTTPS management interface. Despite this, the firewall still presents the old expired certificate when accessed. What is the most likely cause?

A.The firewall must be restarted for the change to take effect.

B.The new certificate was not committed.

C.The old certificate is still bound to a different service.

D.The browser has cached the old certificate.

AnswerB

Committing is required to apply the new certificate.

Why this answer

In Palo Alto Networks firewalls, changes to management interface settings, including certificate assignments, require a commit operation to become active. Generating and assigning the new certificate through the GUI only stages the change; without a commit, the firewall continues to use the previously committed configuration, which still references the expired certificate. This is why the old certificate persists despite the assignment.

Exam trap

The trap here is that candidates assume GUI assignments take effect immediately, overlooking the mandatory commit step required for all configuration changes on Palo Alto firewalls.

How to eliminate wrong answers

Option A is wrong because restarting the firewall is not required for certificate changes; a commit is sufficient to apply the new configuration. Option C is wrong because the question states the certificate was assigned to the HTTPS management interface, and even if bound elsewhere, the management interface would use its own assigned certificate. Option D is wrong because the browser caching the old certificate would only affect the client-side display, not the server-side presentation; the firewall itself is serving the old certificate due to the uncommitted change.

Practice this question →

64

Multi-Selectmedium

Which TWO methods are valid for managing a Palo Alto Networks firewall? (Select two)

Select 2 answers

B.SNMP (Read/Write)

AnswersC, D

HTTPS is used for web-based management.

Why this answer

HTTPS (port 443) is the standard web-based management interface for Palo Alto Networks firewalls, providing encrypted GUI access via the Panorama or local web interface. SSH (port 22) is the secure CLI access method, allowing command-line management with encryption and authentication. Both are explicitly supported and recommended for secure management.

Exam trap

The trap here is that candidates often confuse SNMP's read/write community strings with management capability, but SNMP on Palo Alto Networks firewalls is strictly for monitoring and cannot be used to change configuration or perform administrative tasks.

Practice this question →

65

Multi-Selectmedium

Which TWO conditions must be true for intra-zone traffic to be allowed between two interfaces in the same zone?

Select 2 answers

A.The interfaces are in the same virtual router

B.Intra-zone default rule is set to allow

C.The zones are in the same vsys

D.The interfaces are in the same virtual wire

E.A security policy explicitly allows the traffic

AnswersA, E

Interfaces must be in the same virtual router for routing.

Why this answer

Intra-zone traffic between two interfaces in the same zone requires that both interfaces belong to the same virtual router (Option A) because the virtual router defines the routing table and forwarding domain. Without this, the firewall cannot route packets between the interfaces even if they are in the same zone. Additionally, a security policy must explicitly allow the traffic (Option E), as Palo Alto Networks firewalls default to a deny-all posture; no traffic is permitted without an explicit rule.

Exam trap

The trap here is that candidates often assume the intra-zone default rule (Option B) is a mandatory condition, but it is actually a default behavior that can be changed; the question requires conditions that must be true, and the default rule is not strictly necessary if an explicit security policy exists.

Practice this question →

66

Multi-Selecteasy

Which TWO management methods allow CLI access to a Palo Alto Networks firewall?

Select 2 answers

B.Serial console

AnswersA, B

SSH provides secure CLI access.

Why this answer

SSH (Secure Shell) is a standard management method that provides encrypted CLI access to Palo Alto Networks firewalls, allowing administrators to execute commands securely over a network. The serial console port on the firewall provides direct, out-of-band CLI access for initial configuration or troubleshooting when network connectivity is unavailable.

Exam trap

The trap here is that candidates often confuse management methods that provide GUI access (HTTPS) with those that provide CLI access, or incorrectly assume that Telnet is still a supported option on modern firewalls due to its prevalence in older networking equipment.

Practice this question →

67

MCQeasy

An administrator needs to access the firewall's CLI via SSH, but the default SSH port (22) is blocked by the corporate firewall. Which configuration allows SSH on a non-standard port?

A.Device > Setup > Management > Port for SSH

B.Device > Setup > Services > SSH Port

C.Device > Setup > Management > Port for HTTP/HTTPS

D.Device > Administration > SSH Port

E.Device > Setup > Operations > SSH

AnswerA

Allows setting a non-default SSH port for CLI access.

Why this answer

Option A is correct because the firewall's SSH port is configured under Device > Setup > Management > Port for SSH. This setting allows the administrator to change the default TCP port 22 to any non-standard port, enabling SSH access when the corporate firewall blocks the default port. The management interface settings control all inbound management protocols, including SSH, HTTPS, and ping.

Exam trap

The trap here is that candidates confuse the management port settings for SSH with other protocol settings (like HTTP/HTTPS) or assume a 'Services' or 'Administration' menu exists, leading them to pick an option that sounds plausible but does not exist in the PAN-OS GUI.

How to eliminate wrong answers

Option B is wrong because there is no 'Services' submenu under Device > Setup; SSH port configuration is under 'Management', not 'Services'. Option C is wrong because 'Port for HTTP/HTTPS' controls web-based management access, not SSH. Option D is wrong because there is no 'Administration' menu under Device; SSH port settings are not located there.

Option E is wrong because 'Operations' under Device > Setup is for operational tasks like rebooting or generating tech support files, not for configuring SSH port settings.

Practice this question →

68

MCQhard

A company is deploying a Palo Alto firewall in a high-availability (HA) pair. They want to ensure that when a failover occurs, session information is preserved to maintain active connections. Which feature must be enabled?

A.Session synchronization

B.Stateful failover

C.Packet buffer

D.Session Timer adjustment

AnswerA

It mirrors sessions to the peer for stateful failover.

Why this answer

Session synchronization (option A) is the correct feature because it enables the active firewall to share session table entries with the passive peer in real time. When a failover occurs, the newly active firewall already has the session state, so it can continue forwarding traffic for existing connections without interruption. Without session synchronization, all active sessions would be dropped and must be re-established by clients.

Exam trap

The trap here is that candidates confuse the general concept of 'stateful failover' (which is the desired outcome) with the specific feature name that must be enabled in the Palo Alto configuration, leading them to select option B instead of the precise mechanism 'session synchronization'.

How to eliminate wrong answers

Option B (Stateful failover) is wrong because it is a generic term describing the overall capability of preserving state during failover, not a specific feature that must be enabled; the actual mechanism that achieves this in Palo Alto firewalls is session synchronization. Option C (Packet buffer) is wrong because it refers to temporary storage of packets during congestion or processing delays, not to sharing session state between HA peers. Option D (Session Timer adjustment) is wrong because modifying session timeouts affects how long idle sessions remain in the table, but does not replicate session information to the standby firewall.

Practice this question →

69

MCQmedium

An enterprise wants to receive SNMP traps from their firewalls for critical events such as HA state changes and high CPU usage. They have an SNMP trap receiver at 10.1.1.100. What configuration steps are required?

A.Use the CLI command 'set snmp trap' with the receiver IP.

B.Configure an SNMP manager and select the traps to send.

C.Enable SNMP on the management interface and set the trap destination.

D.Configure an SNMP server profile for traps and a log forwarding profile to send system logs as traps.

AnswerD

Correct: SNMP server profile defines trap destinations; log forwarding profile selects which logs trigger traps.

Why this answer

Option D is correct because PAN-OS requires an SNMP server profile to define the trap receiver (IP, port, version) and a log forwarding profile to map specific system logs (e.g., HA state changes, high CPU) to be sent as SNMP traps. This two-step configuration ensures only critical events are forwarded as traps, not all SNMP data.

Exam trap

The trap here is that candidates confuse enabling SNMP for polling (Option C) with the separate, mandatory step of configuring trap forwarding via a log forwarding profile, assuming that simply setting a trap destination is enough to send all SNMP data.

How to eliminate wrong answers

Option A is wrong because the CLI command 'set snmp trap' does not exist in PAN-OS; SNMP trap configuration is done via GUI or CLI using 'set snmp-server profile' and log forwarding. Option B is wrong because configuring an SNMP manager alone only sets up the management station for polling, not for sending traps; traps require a separate trap destination and log forwarding profile. Option C is wrong because enabling SNMP on the management interface only allows SNMP polling (get/set) and does not configure trap destinations; trap receivers must be defined in an SNMP server profile.

Practice this question →

70

Matchingmedium

Match each protocol to its default port used by Palo Alto Networks.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

443

22

N/A (ICMP)

161

Why these pairings

These are common ports used for management access.

Practice this question →

71

MCQhard

An organization is deploying a firewall in a high-availability (HA) pair. The administrator wants to ensure that session state is synchronized between the firewalls so that active sessions are not dropped during failover. Which configuration is required?

A.Configure HA1 and HA2 interfaces with appropriate IPs

B.Enable Config Sync on the HA General tab

C.Enable Session Setup and State Synchronization under HA configuration

D.Configure Path Monitoring to detect link failures

AnswerC

These settings enable the synchronization of session state information between HA peers.

Why this answer

Option C is correct because session state synchronization (also known as stateful failover) requires enabling both Session Setup and State Synchronization under the HA configuration. This ensures that the active firewall's session table is continuously replicated to the passive firewall, so when a failover occurs, existing sessions are not dropped and can continue without interruption.

Exam trap

The trap here is that candidates confuse Config Sync (which synchronizes configuration files) with Session State Synchronization (which synchronizes active session data), leading them to select Option B instead of C.

How to eliminate wrong answers

Option A is wrong because configuring HA1 and HA2 interfaces with appropriate IPs is necessary for HA communication (heartbeat and backup links), but it does not enable session state synchronization by itself. Option B is wrong because Config Sync synchronizes configuration files (policies, objects) between firewalls, not session state; it is unrelated to preserving active sessions during failover. Option D is wrong because Path Monitoring detects link failures to trigger failover, but it does not replicate session state; it only helps decide when to fail over, not what happens to existing sessions.

Practice this question →

72

MCQmedium

A network administrator notices that a specific user behind a PA-820 firewall is unable to reach a critical SaaS application, while other users can access it without issues. The administrator checks the traffic logs and sees the session is being denied. Which step should the administrator take next to identify the root cause?

A.Check the System log for related entries

B.Run a packet capture on the ingress interface

C.Check the global counters for dropped packets

D.Check the Traffic log with the session's source IP and destination

AnswerD

Traffic log shows the rule that matched and the action taken.

Why this answer

Option D is correct because the Traffic log already shows the session is denied, and filtering by the specific user's source IP and the destination SaaS application will reveal the exact security policy or rule that is blocking the traffic. This allows the administrator to identify whether the issue is due to a misconfigured policy, an application override, or a user-specific rule, rather than a global or interface-level problem.

Exam trap

The trap here is that candidates may jump to packet capture or system logs without first using the Traffic log's filtering capabilities to pinpoint the exact security rule causing the deny, wasting time on broad diagnostics.

How to eliminate wrong answers

Option A is wrong because the System log records administrative events, system errors, and configuration changes, not per-session deny decisions; it would not show why a specific user's session to a SaaS app was denied. Option B is wrong because running a packet capture on the ingress interface is a more advanced troubleshooting step that should be taken only after analyzing the Traffic log to confirm the deny is not due to a security policy; it is premature and may generate excessive data without narrowing down the cause. Option C is wrong because global counters provide aggregate statistics on dropped packets (e.g., for resource exhaustion or hardware issues) but do not reveal which security policy or rule denied a specific user's session to a particular destination.

Practice this question →

73

MCQmedium

Refer to the exhibit. The firewall is experiencing performance issues and dropping sessions. Based on the exhibit, what is the most likely cause?

A.Dataplane resources are exhausted

B.The firewall has been recently rebooted

C.System CPU is too high

D.The session limit is being reached

AnswerA

Dataplane CPU at 89% and memory at 92% indicate the dataplane is overloaded, causing drops.

Why this answer

The exhibit shows that the dataplane (DP) utilization is at 100%, which directly indicates that the dataplane resources are exhausted. When the dataplane is fully utilized, the firewall cannot process new sessions or maintain existing ones, leading to session drops and performance issues. This is the most likely cause because the dataplane handles packet forwarding and session setup, and its exhaustion is a common bottleneck in high-throughput environments.

Exam trap

Palo Alto Networks often tests the distinction between management plane (system CPU) and dataplane resources, so the trap here is that candidates confuse high system CPU with dataplane exhaustion, not realizing that session drops are almost always a dataplane issue, not a management plane one.

How to eliminate wrong answers

Option B is wrong because a recent reboot would typically show low dataplane utilization and a gradual increase as sessions build up, not sustained 100% utilization with session drops. Option C is wrong because system CPU (management plane) being high does not directly cause session drops; the dataplane operates independently, and high system CPU affects management tasks like logging or UI responsiveness, not packet forwarding. Option D is wrong because the session limit being reached would show a session count at the maximum configured limit in the exhibit, but the exhibit shows dataplane utilization at 100% without indicating the session limit is hit; session limits are a separate resource constraint that triggers specific 'max-session' drops, not general performance degradation from dataplane exhaustion.

Practice this question →

74

Multi-Selectmedium

Which TWO of the following are valid methods to collect a technical support file from a Palo Alto Networks firewall?

Select 2 answers

A.Using the CLI command 'save config to tftp'

B.Using the GUI under Monitor > Packet Capture

C.Using the GUI under Device > Troubleshooting > Generate Tech Support File

D.Using the CLI command 'generate tech-support file'

E.Using the CLI command 'show tech-support'

AnswersC, D

This is the GUI method to generate and download the file.

Why this answer

Option C is correct because the Palo Alto Networks firewall GUI provides a dedicated path under Device > Troubleshooting > Generate Tech Support File to generate and download a comprehensive technical support file. This file bundles logs, configuration, and system state data essential for troubleshooting.

Exam trap

The trap here is confusing the CLI command 'show tech-support' (which is a Cisco IOS command) with the correct Palo Alto Networks command 'generate tech-support file', leading candidates to select an invalid option.

Practice this question →

75

MCQmedium

A company deploys a pair of firewalls in Active/Passive HA. To ensure that active sessions are preserved during failover, which interface must be configured for state synchronization?

A.HA3

B.HA1

C.HA2

D.HA4

AnswerA

HA3 is used for session state synchronization.

Why this answer

In an Active/Passive HA pair, state synchronization (session table, ARP table, etc.) is transmitted over the dedicated HA3 interface. This ensures that when a failover occurs, the passive firewall has an exact copy of all active sessions and can continue forwarding traffic without interruption. Without HA3 configured, sessions are not preserved and must be re-established after failover.

Exam trap

The trap here is that candidates often confuse HA2 (used for packet forwarding in Active/Active) with the state sync interface, or assume HA1 handles all synchronization, but Palo Alto Networks specifically separates control (HA1), data (HA2), and state sync (HA3) functions.

How to eliminate wrong answers

Option B (HA1) is wrong because HA1 is the control link used for heartbeat and configuration synchronization, not for session state data. Option C (HA2) is wrong because HA2 is the data link used for packet forwarding and session setup in Active/Active HA, not for state synchronization in Active/Passive. Option D (HA4) is wrong because HA4 is not a standard interface in Palo Alto Networks HA; the valid interfaces are HA1, HA2, and HA3 only.

Practice this question →

Page 1 of 2 · 116 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Device Mgmt Services questions.

Start 20-question session