Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select 3 answers.
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
E:Sessions are not synchronized between the two devices. C: IPSec tunnels will be broken, so remote connectivity will temporarily be disrupted. B:Active/Active is not supported.
Correct Answer B C & D HA Lite is an active/passive deployment that provides configuration synchronization and some run-time data synchronization such as IPsec security associations. It does not support session synchronization (HA2), and therefore does not offer stateful failover.
IPSec SAs and IKE SAs (both phase 1 and phase 2) are not synchronized between HA peers. This is because IPSec Security Associations are dynamically established and include unique session keys and parameters negotiated during the IKE handshake.