Manage and Operate
Free Palo Alto Networks Certified Network Security Engineer practice — 6 questions on Manage and Operate, with explanations. No sign-up. Full 12-question mixed test →
A firewall pair is deployed in active/active HA. Due to asymmetric routing upstream, return traffic for a session sometimes arrives at the non-owning firewall. The security policy has 'Forward packets to session owner' behavior expected, but sessions are being dropped instead. Which HA component should the administrator verify is correctly configured to resolve this?
In active/active HA, HA3 is a dedicated Layer 2 link used exclusively to forward packets between peers when a session's traffic arrives at the non-owning firewall due to asymmetric routing, allowing the session owner to process it correctly.
An administrator upgrades a firewall from PAN-OS 11.1 to 10.2 after encountering stability issues, but wants to preserve as much of the pre-upgrade configuration as possible and avoid content pack incompatibility errors. What is the correct approach?
PAN-OS automatically saves a configuration snapshot before an upgrade. To downgrade safely, the administrator must first ensure the installed content release is compatible with the older PAN-OS version (newer content packs can be incompatible with older releases), then downgrade and load the saved pre-upgrade config file to restore settings that may not survive the version change.
GlobalProtect gateway authentication uses client certificates issued by an enterprise intermediate CA. Users with valid, unexpired certificates fail authentication with certificate validation errors. The root CA certificate is correctly installed in the certificate profile. What is the most likely cause?
PAN-OS validates the full certificate chain from the client certificate up to a trusted root. If only the root CA is present in the certificate profile and the intermediate CA is missing, the chain cannot be built, causing valid certificates to fail validation even though they are not expired or revoked.
Mobile users frequently lose GlobalProtect connectivity due to unstable Wi-Fi and cellular handoffs. The security team wants users to automatically reconnect without re-entering credentials for a limited, defined period after the initial successful authentication. Which configuration achieves this?
GlobalProtect supports generating an authentication cookie on the portal after successful authentication; when the gateway is configured to accept this cookie, the client can reconnect automatically within the cookie's validity period without re-prompting for credentials.
A Panorama Log Collector Group contains three Log Collectors. The administrator enables log redundancy for the group. What is the direct operational impact of this change?
Enabling log redundancy in a Log Collector Group causes each log to be stored on two different Log Collectors instead of one, which protects against data loss if a collector fails, but it consumes roughly double the storage per log, cutting effective usable capacity by about half. Redundancy requires at least two Log Collectors in the group.
Two administrators are working on the same firewall's candidate configuration simultaneously: Admin A is midway through modifying several security policy rules, while Admin B is preparing to commit unrelated NAT changes. To prevent Admin B from committing while Admin A's edits are incomplete, thereby avoiding an inconsistent partial configuration push, which action should Admin A take before starting the edits?
The Commit Lock (Configuration > Take Commit Lock) prevents any administrator from committing the candidate configuration until the lock is released, ensuring no one commits while another admin's edits are in progress — exactly the protection needed in this scenario.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →