PCNSE High Availability and Redundancy 3

Question 1

Which HA state indicates that a firewall is actively passing traffic and enforcing policy?

Accepted Answer

Active

Answer

The 'Active' HA state means the firewall is fully operational, processing user traffic, and enforcing security policies.

Question 2

What does the 'HA Suspended' state mean on a Palo Alto firewall?

Accepted Answer

The firewall has been administratively removed from the HA pair and will not take over

Answer

A Suspended HA firewall has been manually taken out of the HA pair by an administrator and will not participate in failover.

Question 3

In a Palo Alto HA pair, which sessions are synchronized to the Passive firewall by default?

Accepted Answer

All established sessions including TCP, UDP, and ICMP

Answer

By default, the HA2 link synchronizes all established sessions so the Passive firewall can continue them transparently after a failover.

Question 4

What minimum HA timer setting results in the fastest failover detection but highest CPU overhead?

Accepted Answer

Aggressive

Answer

Aggressive HA timer settings use shorter heartbeat intervals and faster failure detection, providing quicker failover at the cost of increased CPU utilization.

Question 5

Which Palo Alto feature allows a virtual IP address to move between HA peers during failover, ensuring uninterrupted connectivity?

Accepted Answer

Floating IP

Answer

A Floating IP is a virtual IP address configured on an HA pair that moves to the currently Active firewall, maintaining connectivity for downstream devices.

PCNSE Exam Practice Test

PCNSE Exam Practice Test

PCNSE High Availability and Redundancy 3