PCNSE High Availability and Redundancy 2 — Questions and Answers
Question 1: Which HA configuration setting determines which firewall becomes Active when both peers are healthy and preemption is enabled?
- Device Serial Number
- HA Group ID
- HA Device Priority (Correct answer)
- Management IP Address
Correct answer: HA Device Priority
HA Device Priority (lower numerical value = higher priority) determines which firewall takes the Active role when both devices are healthy.
Question 2: What is the recommended best practice for the HA1 Control Link to ensure high reliability?
- Use the management interface as the only HA1 link
- Configure an HA1 backup link on a separate physical interface (Correct answer)
- Use a wireless interface for HA1
- Share the HA1 link with data traffic
Correct answer: Configure an HA1 backup link on a separate physical interface
Configuring a backup HA1 link on a separate physical interface ensures control link redundancy in case the primary HA1 path fails.
Question 3: In Palo Alto HA, what is the 'split brain' condition?
- Both firewalls simultaneously processing the same session
- Both firewalls believing they are Active at the same time (Correct answer)
- The HA2 link failing during a commit
- A firewall entering a suspended HA state
Correct answer: Both firewalls believing they are Active at the same time
Split brain occurs when both HA peers simultaneously assume the Active role, typically due to a loss of the HA1 control link, causing traffic disruption.
Question 4: Which HA feature allows a Palo Alto firewall to monitor an upstream router and trigger failover if the path fails?
- Link Monitoring
- Path Monitoring (Correct answer)
- BFD
- OSPF Graceful Restart
Correct answer: Path Monitoring
Path Monitoring sends ICMP probes to specified IP addresses and triggers HA failover if the monitored path becomes unreachable.
Question 5: What is the function of the HA3 link in an Active/Active HA deployment?
- To carry heartbeat messages
- To forward packets between peers when a session is owned by one firewall but traffic arrives at the other (Correct answer)
- To synchronize configuration only
- To connect to the Panorama management server
Correct answer: To forward packets between peers when a session is owned by one firewall but traffic arrives at the other
The HA3 link in Active/Active mode forwards packets between peers when asymmetric routing sends return traffic to the firewall that did not originate the session.
Question 6: When performing a software upgrade on an HA pair, what is the recommended procedure to avoid downtime?
- Upgrade both firewalls simultaneously during a maintenance window
- Upgrade the Passive firewall first, then manually fail over, then upgrade the original Active (Correct answer)
- Disable HA before upgrading either device
- Upgrade the Active firewall first to test the new software
Correct answer: Upgrade the Passive firewall first, then manually fail over, then upgrade the original Active
The recommended procedure is to upgrade the Passive firewall first, perform a manual failover so it becomes Active, then upgrade the original Active firewall.
PCNSE High Availability and Redundancy 2
Which HA configuration setting determines which firewall becomes Active when both peers are healthy and preemption is enabled?