← PCNSE·Palo Alto Networks

Question 218 of 516

Managing Troubleshooting and High Availability →hardMultiple ChoiceObjective-mapped

Split-Brain in Palo Alto HA: Causes and Prevention

This PCNSE practice question tests your understanding of managing troubleshooting and high availability. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

After a power failure, both firewalls in an HA pair come up and report 'active' state. The network team confirms that the two firewalls are connected via HA1 and HA2. What is the most likely cause of the split-brain condition?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

A
The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state
A short hold timer can lead to premature failover during boot.
B
The active firewall has a higher software version
Why wrong: Version mismatch would be detected.
C
Preemption is enabled on both firewalls
Why wrong: Preemption would cause one to become active after the other is already active.
D
HA2 link is configured but not used for election
Why wrong: HA2 does not affect election.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state

Option A is correct because the HA1 keepalive hold timer determines how long a firewall waits for a hello message from its peer before declaring it dead. If this timer is set too low, both firewalls may boot up and not receive each other's initial keepalives in time, causing each to assume the other is unavailable and transition to active state. This results in a split-brain condition where both firewalls operate independently.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state
Why this is correct
A short hold timer can lead to premature failover during boot.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The active firewall has a higher software version
Why it's wrong here
Version mismatch would be detected.
✗
Preemption is enabled on both firewalls
Why it's wrong here
Preemption would cause one to become active after the other is already active.
✗
HA2 link is configured but not used for election
Why it's wrong here
HA2 does not affect election.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse the HA1 keepalive timer with the HA2 link's role in election, assuming HA2 is involved in determining active/passive state, when in fact HA2 is only for session synchronization and not for election.

Detailed technical explanation

How to think about this question

In Palo Alto Networks HA, the HA1 link carries keepalive messages (heartbeats) and election traffic using UDP port 2925. The keepalive hold timer defaults to 2 seconds, but if set too low (e.g., 1 second), a firewall may not receive a keepalive within the window during boot-up, triggering a premature transition to active. This scenario is common in environments with slow link initialization or high latency on the HA1 link, and can be verified by checking the 'show high-availability state' command output for 'active' on both units.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the PCNSE exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PCNSE practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Manage, Monitor and Operate practice questions

Practise PCNSE questions linked to Manage, Monitor and Operate.

Securing Traffic and App-ID practice questions

Practise PCNSE questions linked to Securing Traffic and App-ID.

Securing Users and Applications with Authentication practice questions

Practise PCNSE questions linked to Securing Users and Applications with Authentication.

Decryption and SSL Inspection practice questions

Practise PCNSE questions linked to Decryption and SSL Inspection.

Managing Troubleshooting and High Availability practice questions

Practise PCNSE questions linked to Managing Troubleshooting and High Availability.

Deploy and Configure Firewalls practice questions

Practise PCNSE questions linked to Deploy and Configure Firewalls.

Core Concepts and Architecture practice questions

Practise PCNSE questions linked to Core Concepts and Architecture.

Secure Access and VPN practice questions

Practise PCNSE questions linked to Secure Access and VPN.

Troubleshoot practice questions

Practise PCNSE questions linked to Troubleshoot.

PCNSE fundamentals practice questions

Practise PCNSE questions linked to PCNSE fundamentals.

PCNSE scenario practice questions

Practise PCNSE questions linked to PCNSE scenario.

PCNSE troubleshooting practice questions

Practise PCNSE questions linked to PCNSE troubleshooting.

Practice this exam

Start a free PCNSE practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PCNSE practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PCNSE question test?

Managing Troubleshooting and High Availability — This question tests Managing Troubleshooting and High Availability — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The HA1 keepalive hold timer is set too low, causing both to become active before learning peer state — Option A is correct because the HA1 keepalive hold timer determines how long a firewall waits for a hello message from its peer before declaring it dead. If this timer is set too low, both firewalls may boot up and not receive each other's initial keepalives in time, causing each to assume the other is unavailable and transition to active state. This results in a split-brain condition where both firewalls operate independently.

What should I do if I get this PCNSE question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on PCNSE

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. An administrator notices that the HA pair shows a state mismatch: one firewall reports active, the other reports passive, but traffic is not flowing through the active firewall. What is the most likely cause?

easy

A.Session synchronization is incomplete
B.The HA2 link is down
C.The passive firewall has a higher priority
✓ D.The HA1 link is down and preemptive mode is enabled

Why D: Option D is correct because when the HA1 link is down and preemptive mode is enabled, each firewall may operate independently, leading to a state mismatch where one reports active and the other passive. Traffic does not flow through the active firewall because it lacks the HA1 communication to validate the peer's state. Option A is incorrect because incomplete session synchronization does not cause a state mismatch; it only affects session redundancy. Option B is incorrect because the HA2 link is for session synchronization, not for state determination; a failure would not cause a state mismatch. Option C is incorrect because priority determines which firewall becomes active/passive but does not cause a mismatch; if the passive had higher priority, it would be active.

Variation 2. An HA pair experiences split-brain after a brief network outage. Both firewalls become active and each starts forwarding traffic. What is the most effective way to prevent this in the future?

medium

✓ A.Increase the HA keepalive failover threshold to tolerate temporary packet loss
B.Decrease the HA1 hello interval
C.Enable link monitoring on all interfaces
D.Increase the session synchronization rate

Why A: Option A is correct because increasing the HA keepalive failover threshold allows the firewalls to tolerate a brief network outage without triggering a split-brain scenario. By requiring more missed heartbeats before declaring the peer dead, the firewalls avoid both becoming active simultaneously due to transient packet loss. This directly addresses the root cause—premature failover during temporary connectivity issues.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.