PCNSE High Availability and Redundancy 1 — Questions and Answers
Question 1: In Palo Alto Networks High Availability, what is the role of the Active firewall?
- It processes only management traffic
- It actively processes all network traffic and enforces security policy (Correct answer)
- It synchronizes configuration to the passive peer
- It monitors the passive peer health only
Correct answer: It actively processes all network traffic and enforces security policy
In an Active/Passive HA pair, the Active firewall processes all live network traffic while the Passive firewall stands by in a synchronized state.
Question 2: Which HA link is used to synchronize session tables and runtime data between HA peers?
- HA1 (Control Link)
- HA2 (Data Link) (Correct answer)
- HA3 (Packet Forwarding Link)
- Management Interface
Correct answer: HA2 (Data Link)
The HA2 Data Link synchronizes session state, forwarding tables, and IPsec security associations between the Active and Passive firewalls.
Question 3: What is the purpose of the HA1 Control Link in a Palo Alto HA pair?
- To forward user traffic during failover
- To exchange heartbeats and synchronize configuration between peers (Correct answer)
- To synchronize session tables
- To pass decrypted traffic between peers
Correct answer: To exchange heartbeats and synchronize configuration between peers
The HA1 Control Link carries heartbeat packets, hello messages, and configuration synchronization between HA peers.
Question 4: In Active/Active HA mode, how is traffic distributed between the two firewalls?
- Only one firewall processes traffic at a time
- Both firewalls simultaneously process traffic, typically with a load balancer (Correct answer)
- Traffic is split by protocol type
- Each firewall handles only its own management subnet
Correct answer: Both firewalls simultaneously process traffic, typically with a load balancer
In Active/Active HA, both firewalls process traffic concurrently, usually with an upstream load balancer or ECMP distributing sessions between them.
Question 5: What condition triggers a failover in an Active/Passive HA pair?
- CPU utilization exceeding 50%
- The Active firewall fails a link monitoring or heartbeat check (Correct answer)
- A new policy is committed on the Active firewall
- The Passive firewall receives more traffic
Correct answer: The Active firewall fails a link monitoring or heartbeat check
Failover is triggered when the Active firewall fails link monitoring checks or heartbeats stop, causing the Passive firewall to transition to Active.
Question 6: What does 'preemption' mean in the context of Palo Alto HA?
- The passive firewall blocking all traffic during sync
- The higher-priority firewall automatically reclaiming the Active role after recovery (Correct answer)
- Manually swapping Active and Passive roles
- Disabling HA temporarily for maintenance
Correct answer: The higher-priority firewall automatically reclaiming the Active role after recovery
Preemption allows the firewall with a higher HA priority to automatically take back the Active role once it recovers from a failure.
PCNSE High Availability and Redundancy 1
In Palo Alto Networks High Availability, what is the role of the Active firewall?