An administrator has been asked to configure active/passive HA for a pair of Palo Alto Networks NGFWs. The administrator assigns priority 100 to the active firewall. Which priority is correct for the passive firewall?
The lower the number, the higher the priority.
So if active is higher priority, therefore assigned 100 , then the only one that will be second priority will be with number larger than 100 so Only 255 is applicable. Therefore D is the correct answer.
The correct answer is:
B. 99
Explanation:
In Palo Alto Networks active/passive High Availability (HA) configuration:
The active firewall should have a higher priority (e.g., 100).
The passive (standby) firewall should have a lower priority (e.g., 99).
This ensures that the firewall with the higher priority (100) takes the active role, while the one with the lower priority (99) remains in standby mode.
Why Not the Other Options?
A. 0 – Too low and not a typical best practice (could cause issues if HA negotiation fails).
C. 1 – While technically possible, it’s not the standard approach when the active firewall is set to 100.
D. 255 – This is the default HA priority, not used for passive firewalls in an active/passive setup.
Thus, B (99) is the correct priority for the passive firewall when the active firewall is set to 100.
In an active/passive High Availability (HA) configuration for Palo Alto Networks NGFWs, the firewalls are assigned priorities to determine which firewall will act as the active device and which will act as the passive (standby) device. The firewall with the higher priority becomes the active device.
The active firewall is assigned a priority of 100 (as stated in the question).
The passive firewall should be assigned a lower priority than the active firewall. The most logical and common choice is 99.
This ensures that:
The firewall with priority 100 will always take the active role.
The firewall with priority 99 will remain in standby (passive) mode unless the active firewall fails.
The firewalls in an Active-Passive HA pair can be assigned a device priority value to indicate a preference for which firewall should assume the active role. If you need to use a specific firewall in the HA pair for actively securing traffic, you must enable the preemptive behavior on both the firewalls and assign a device priority value for each firewall. The firewall with the lower numerical value, and therefore higher priority, is designated as active. The other firewall is the passive firewall.
The firewall you plan to make active must have a lower numerical value than its peer. So, if Peer A is to function as the active firewall, keep the default value of 100 and increment the value on PeerB.
firewall with the lower numerical value, and therefore higher priority, is designated as active.
upvoted 3 times
...
This section is not available anymore. Please use the main Exam Page.PCNSE Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Yasi
Highly Voted 7 months ago[Removed]
Most Recent 4 days, 3 hours agoNico1973
3 weeks, 6 days agoNico1973
1 month, 1 week agoStevenWilliams0728
7 months ago327c7c8
1 year agoMarshpillowz
1 year, 3 months agolol12
2 years, 6 months agoTAKUM1y
2 years, 6 months agoniklaus
2 years, 11 months agoKhalidB
3 years, 2 months agodgetaneh
3 years, 10 months agotheroghert
4 years, 2 months agolol1000
4 years, 5 months agonk12
4 years, 8 months agoNib2002
4 years, 9 months agocloudguy365
4 years, 11 months ago