PCNSE Question #526: Real Exam Question with Answer & Explanation

Question

An administrator has configured a pair of firewalls using high availability in Active/Passive mode. Path Monitoring has been enabled with a Failure Condition of "any." A path group is configured with Failure Condition of "all" and contains a destination IP of 8.8.8.8 and 4.2.2.2 with a Ping Interval of 500ms and a Ping count of 3. Which scenario will cause the Active firewall to fail over?

Options

• AIP address 8.8.8.8 is unreachable for 1 second.
• BIP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 1 second.
• CIP addresses 8.8.8.8 and 4.2.2.2 are unreachable for 2 seconds
• DIP address 4.2.2.2 is unreachable for 2 seconds.

Explanation

The failover timing and conditions are determined by two nested failure conditions. The path group failure condition is 'all,' meaning ALL monitored destinations (both 8.8.8.8 AND 4.2.2.2) must be unreachable to declare the path group failed. The path monitoring failure condition is 'any,' meaning just one failing path group is sufficient to trigger failover. The time threshold to declare a destination unreachable is: Ping Interval × Ping Count = 500ms × 3 = 1,500ms (1.5 seconds) of consecutive failures. Answer C (both IPs unreachable for 2 seconds) satisfies all conditions: both destinations fail (meeting the 'all' requirement) and 2 seconds exceeds the 1.5-second threshold. Answer B fails because 1 second is below the 1.5-second threshold. Answers A and D fail because only one IP is unreachable, which does not meet the path group's 'all' failure condition.

No community discussion yet for this question.