Hard Difficulty Questions

Packet filtering rules

Why wrong: Packet filtering does not allocate resources.

Session limit rules

Why wrong: Session limits only restrict the number of sessions, not CPU usage.

QoS profiles

Why wrong: QoS controls traffic bandwidth, not CPU or session resources.

The destination NAT is configured incorrectly.

Why wrong: Destination NAT would not affect outbound sessions; it changes the destination on inbound.

The security policy is missing the return traffic rule.

Why wrong: Security policy is stateful, so return traffic is allowed automatically if the outbound session is allowed.

The firewall is in FIPS mode.

Why wrong: FIPS mode affects encryption, not basic connectivity.

The application's timeout value is too short.

Why wrong: Timeout values affect session keepalive, not identification.

Content-ID is disabled on the security policy.

Why wrong: Content-ID handles data filtering, not application identification.

The application requires URL categorization to be enabled.

Why wrong: URL categorization is separate from App-ID.

CDSS performs full application-level packet inspection.

Why wrong: Packet inspection is done by the firewall, not CDSS.

CDSS is a replacement for the firewall's local threat prevention functionality.

Why wrong: CDSS complements, not replaces, local capabilities.

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Why wrong: TLS 1.3 uses completely different cipher suites and key exchange mechanisms.

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Why wrong: No HSM is required; decryption is done via software.

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Why wrong: TLS 1.3 decryption is supported for both forward proxy and inbound inspection.

Client certificate.

Why wrong: Client certificates are optional; other authentication methods can be used.

DNS suffix.

Why wrong: DNS suffix is optional for client configuration.

It forwards the traffic normally

Why wrong: IP options are not forwarded by default; they are dropped.

It logs and alerts

Why wrong: Logging and alerting occur only if specific security rules or profiles are configured.

It strips the IP options and forwards

Why wrong: The firewall does not strip IP options; it drops packets with them.

Active/Passive HA with virtual router synchronization

Why wrong: VR synchronization is a mechanism within HA, not a separate redundancy method.

Use of multiple public IPs with NAT rules

Why wrong: Multiple IPs alone do not provide redundancy; routing must also be configured.

The HA2 link is down.

Why wrong: HA2 is for configuration synchronization; session sync uses HA3.

The passive firewall does not have management API access.

Why wrong: API access is not required for session synchronization.

The logging settings on both firewalls are different.

Why wrong: Logging settings do not affect session synchronization.

The firewall is experiencing a SYN flood attack.

Why wrong: SYN floods are indicated by a high 'tcp_syn_flood_counter' or similar, not MSS errors.

There is a routing loop causing packet retransmission.

Why wrong: Routing loops are indicated by TTL expired counters, not MSS errors.

The firewall's hardware acceleration is failing.

Why wrong: Hardware failures are not indicated by this specific counter.

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Why wrong: Server Monitoring is for the firewall to receive user mappings from the Agent, not send.

An Application Override policy must be created for User-ID traffic.

Why wrong: Application override is not needed for User-ID; the traffic is identified via service.

The User-ID Agent must be in the same Layer 2 subnet as the users.

Why wrong: User-ID Agent can be anywhere as long as network connectivity exists.

Create a security policy rule allowing the traffic between the zones.

Why wrong: Security policy is necessary but does not solve the routing issue.

Configure route redistribution between VR-A and VR-B using a routing protocol.

Why wrong: This would work but is overkill for a single subnet; simpler to add a static route.

Place all interfaces in the same virtual router.

Why wrong: This would break the segmentation that the company wants.

Insufficient disk space on the log partition.

Why wrong: Disk space affects storage, not CPU directly.

BGP prefix flapping causing route recalculations.

Why wrong: BGP flapping can cause CPU, but it's less common than the others; may be considered plausible but not a top three.

The IPSec crypto profile is too strong for the clients.

Why wrong: Crypto profile mismatch would cause tunnel failure, not authentication failure within an established connection.

The IP pool is exhausted.

Why wrong: IP pool exhaustion would prevent client from obtaining an IP, but authentication would still succeed.

The DNS server is misconfigured, causing authentication failure.

Why wrong: DNS server is used by clients for name resolution, not for authentication.

The passive firewall's routing table is not synchronized.

Why wrong: HA synchronizes routing tables, so this should not be an issue.

The virtual router is not configured to use the virtual IPs.

Why wrong: Virtual IPs are automatically assigned to the virtual router in HA.

The HA configuration does not include the virtual router.

Why wrong: HA synchronizes virtual router configuration between peers.

Enable Multi-Factor Authentication for all admins.

Why wrong: MFA enhances authentication security but does not restrict commit permissions.

Use template stacks to restrict commit permissions.

Why wrong: Template stacks are for managing configuration templates, not commit permissions.

Set the firewall to require approval for commits.

Why wrong: The firewall does not have a native commit approval feature; this would need external workflow.

Check HA1 link utilization

Why wrong: HA1 is not used for session sync.

Increase the packet buffer protection threshold

Why wrong: Packet buffer does not affect sync.

Restart the HA process on both firewalls

Why wrong: Restart is disruptive and not diagnostic.

Restart the HA process on the passive firewall with 'debug software restart high-availability'

Why wrong: Restart does not fix config mismatch.

Failover the active firewall to force re-sync

Why wrong: Failover would cause traffic disruption.

Upgrade both firewalls to the same PAN-OS version

Why wrong: Versions are likely same; mismatch is config, not version.

Change the HA mode to Active/Passive

Why wrong: Would reduce capacity.

Increase the HA2 link bandwidth using link aggregation

Why wrong: Link aggregation helps with sync bandwidth, not distribution.

Enable session synchronization for all sessions

Why wrong: Synchronizing all would increase CPU and memory.

The active firewall has a higher software version

Why wrong: Version mismatch would be detected.

Preemption is enabled on both firewalls

Why wrong: Preemption would cause one to become active after the other is already active.

HA2 link is configured but not used for election

Why wrong: HA2 does not affect election.