PCNSE Question #169: Real Exam Question with Answer & Explanation

Question

An administrator is using Panorama and multiple Palo Alto Networks NGFWs. After upgrading all devices to the latest PAN-OS?software, the administrator enables log forwarding from the firewalls to Panorama. Pre-existing logs from the firewalls are not appearing in Panorama. Which action would enable the firewalls to send their pre-existing logs to Panorama?

Options

• AUse the import option to pull logs into Panorama.
• BA CLI command will forward the pre-existing logs to Panorama.
• CUse the ACC to consolidate pre-existing logs.
• DThe log database will need to exported form the firewalls and manually imported into Panorama.

Explanation

Option B is correct because PAN-OS provides a specific CLI command on the firewall (request log-forwarding panorama push all or similar) that forces the device to push locally stored pre-existing logs up to Panorama - this functionality is intentionally only exposed via the CLI, not the GUI, since it's a one-time remediation action rather than a routine operation.

A is wrong because Panorama has no native "import" pull mechanism to reach into a firewall and retrieve its local logs on demand - log flow is push-based from the firewall.

C is wrong because the ACC (Application Command Center) is a visualization and analysis tool for traffic summary data; it has no ability to consolidate or migrate raw log databases.

D is wrong because there is no supported workflow to export a firewall's log database and manually import it into Panorama - the log storage formats and ingestion paths don't work that way.

Memory tip: Remember "pre-existing = CLI fix" - anything involving historical data that the GUI can't handle in Palo Alto's ecosystem usually has a hidden CLI command. When Panorama misses the past, the firewall's command line holds the key.

No community discussion yet for this question.