Troubleshooting practice questions

The TCP sequence numbers are out of order, causing the packets to be out of the expected window.

Why wrong: Out-of-order sequence numbers cause tcp-out-of-window drops, not tcp-non-syn.

The NAT policy is misconfigured, causing the source IP to not be translated correctly.

Why wrong: NAT misconfiguration leads to NAT-related drops, not tcp-non-syn.

The security policy uses an incorrect service object that doesn't match the application.

Why wrong: Incorrect service would cause application-mismatch, not tcp-non-syn.

A DDoS attack is flooding the firewall with SYN packets.

Why wrong: SYN flood would show very high tcp-conn-init, not just half-open.

The firewall's TCP timeout setting is too short.

Why wrong: Short timeouts would reduce half-open count, not increase it.

The firewall's hardware is failing.

Why wrong: Hardware failure would show more generic errors, not specific half-open count.

The rule is configured as an intrazone rule.

Why wrong: An intrazone rule would apply within the same zone, but the traffic is between different zones (Engineering and DMZ).

The rule is disabled in the rulebase.

Why wrong: If disabled, the rule would not appear in the rulebase or would be greyed out; there is no such indication.

SSL decryption is blocking the traffic.

Why wrong: There is no indication of decryption; the issue is policy mismatch.

Whether logging is enabled on the rule.

Why wrong: Logging is for visibility, not for blocking decision.

Whether SSL decryption is enabled for the traffic.

Why wrong: Decryption is for inspection, not a direct cause of blocking.

Using the CLI command 'save config to tftp'

Why wrong: This saves configuration, not tech support.

Using the GUI under Monitor > Packet Capture

Why wrong: That is for packet captures, not tech support.

Using the CLI command 'show tech-support'

Why wrong: This displays output but does not generate a downloadable file.

The firewall has not received the latest App-ID update.

Why wrong: App identification is done locally; updates add new apps but do not affect existing ones.

SSL decryption is not configured.

Why wrong: YouTube is identified without decryption.

A security rule is blocking the sub-application.

Why wrong: If blocked, traffic would be denied, not reclassified.

Packet size exceeds the maximum transmission unit.

Why wrong: Packet size is unrelated.

Application override configured for HTTP

Why wrong: Application override would not cause session mismatch; it would force the application identification regardless of port.

DNS resolution failure

Why wrong: DNS resolution failure would prevent the user from resolving the server's IP address, but would not cause session mismatch for return traffic.

NAT policy mismatch

Why wrong: NAT policy mismatch would affect address translation but not the session lookup for return traffic.

The security rule is not placed at the top of the rulebase.

Why wrong: The rule is matching, so its position is not the issue.

A zone protection profile is blocking the traffic.

Why wrong: Zone protection profiles block based on flood or reconnaissance attacks, not normal traffic.

The destination server does not have a route back to the 192.168.1.0/24 subnet.

Why wrong: The firewall handles asymmetric routing; return traffic is not the issue here.

To block the traffic, you can set the source zone in Rule2 to 'Negate' Engineering.

Why wrong: There is no 'Negate' option for zones; you must reorder rules or use different criteria.

Moving Rule2 to the end of the rulebase will ensure it blocks the traffic.

Why wrong: Moving Rule2 after Rule3 would still not match if Rule1 allows first; the order among the first two is critical.

The firewall evaluates all rules and applies the most restrictive action (deny).

Why wrong: Palo Alto firewalls use first-match, not most restrictive; they stop at the first matching rule.

Config Logs

Why wrong: Config logs show configuration changes, not failure details.

System Logs

Why wrong: System logs are not as specific to decryption issues.

Threat Logs

Why wrong: Threat logs show security threats, not decryption failures.

System logs

Why wrong: System logs cover firewall system events, not decryption actions.

URL Filtering logs

Why wrong: URL Filtering logs show URL categories and policy actions, not decryption specifics.

Threat logs

Why wrong: Threat logs record security threats, not decryption details.

HTTP

Why wrong: HTTP is insecure and often disabled to enforce HTTPS.

Telnet

Why wrong: Telnet is insecure and rarely used, typically disabled.

Disable decryption during peak hours.

Why wrong: Disabling decryption reduces security visibility.

Use the 'decryption' log type.

Why wrong: There is no dedicated 'decryption' log type; decryption logs are part of traffic logs.

Export decrypted traffic to a log collector.

Why wrong: Exporting is for archival, not real-time monitoring.

The application is using a non-standard port.

Why wrong: Non-standard ports can still be identified with custom signatures.

The firewall could not determine the application.

Why wrong: 'Incomplete' means the firewall started identification but could not finish.

The application is unknown to the firewall.

Why wrong: Unknown applications are shown as 'unknown-tcp' or 'unknown-udp'.

The client does not trust the firewall's CA certificate.

Why wrong: Client trust issues result in browser warnings, not firewall error 'certificate_unknown'.

The server certificate is expired.

Why wrong: An expired certificate would cause a different error like 'certificate_expired'.

The decryption policy has an incorrect source zone.

Why wrong: Incorrect policy would cause no decryption attempt, not this error.

Confirm that the decryption profile is set to 'decrypt' and that the forward proxy option is enabled.

Why wrong: Forward proxy is for outbound decryption; inbound decryption uses 'SSL Inbound Inspection' method.

Verify that the server's certificate is installed on the firewall.

Why wrong: Inbound decryption requires the server's private key, not just the certificate; simply installing the cert is insufficient.

Ensure that the firewall has a valid certificate for inbound inspection.

Why wrong: Inbound inspection uses the destination server's certificate, not a firewall certificate.

Enable 'Management' profile on the VLAN interface

Why wrong: VLAN interface is not applicable; data interfaces use interface management profiles.

Create a security policy allowing ICMP and SSH inbound

Why wrong: Security policies control traffic forwarding, not management access.

Enable the service route for ping and SSH

Why wrong: Service routes control egress source, not inbound permissions.

The rule requires a separate application object

Why wrong: Service objects alone can match DNS traffic on standard ports.

The security policy action is set to deny

Why wrong: If set to deny, UDP would also be blocked.

The service group is incorrectly configured

Why wrong: The group itself may be fine, but the member objects might be missing TCP.