PCNSE Practice Test 10 — 10 Questions

Question 1

Refer to the exhibit. A firewall log shows these messages for an IPSec tunnel. Which configuration mismatch is the likely cause?

Accepted Answer

IKE Phase 2 proposal mismatch.. The log indicates Phase 2 negotiation failed due to no acceptable proposal set. This points to a mismatch in IPSec parameters (e.g., encryption, authentication, lifetime).

Answer

IKE Phase 1 proposal mismatch.

Answer

Preshared key mismatch.

Answer

Invalid peer IP address.

Question 2

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

Accepted Answer

debug ike global on. The 'debug ike global on' command enables detailed IKE negotiation logging, which is essential for diagnosing tunnel establishment failures.

Answer

show counter global | match ipsec

Answer

show log system

Answer

debug flow basic

Question 3

Which THREE of the following are capabilities of GlobalProtect Host Information Profile (HIP)?

Accepted Answer

Check if antivirus is installed and running. HIP collects system information such as OS, antivirus, disk encryption, and firewall status to enforce compliance.

Answer

Check the user's location

Answer

Check the browser version

Question 4

Which TWO conditions are required for a successful GlobalProtect connection using certificate authentication?

Accepted Answer

The client certificate must be issued by a CA trusted by the firewall.. Certificate authentication requires the client certificate to be trusted by the firewall (the CA must be trusted), and the GlobalProtect portal must have an SSL certificate for the web interface.

Answer

The user's browser must have the firewall's root CA certificate.

Answer

The firewall must have the client certificate's public key.

Answer

The client must have a valid username and password.

Question 5

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

Accepted Answer

The gateway's 'Allow Access' list does not include the user. Even after authentication, the gateway's 'Allow Access' list controls which users are permitted to establish the VPN tunnel. If the user is not listed, the gateway will reject the connection.

Answer

The user's GlobalProtect client software is outdated

Answer

The gateway's interface is not in the same zone as the portal

Answer

The portal's 'Access' list does not include the user

Question 6

What is the most likely cause of Phase2 being down?

Accepted Answer

Mismatched IPSec encryption or authentication settings. The Phase2 state is DOWN because the IPsec proposals (encryption, authentication, lifetime) do not match between the two tunnel endpoints.

Answer

Mismatched IKE version

Answer

Wrong tunnel interface IP address

Answer

Incorrect pre-shared key

Question 7

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Accepted Answer

Verify the routing table on both firewalls.. Common causes for no traffic despite tunnel up include mismatched proxy IDs, missing security policies, or routing issues.

Answer

Increase the IPSec SA lifetime.

Answer

Ensure the tunnel interface is placed in a virtual router.

Question 8

When configuring GlobalProtect with certificate authentication, a user reports that the client prompts for username and password even though the certificate is installed. What is the most likely cause?

Accepted Answer

The portal authentication profile requires both certificate and password. When the portal authentication profile requires both certificate and password, the client will prompt for credentials even if a valid certificate is present.

Answer

The certificate is expired

Answer

The client certificate does not match the username

Answer

The root CA certificate is not imported into the firewall

Question 9

A user tries to connect to the GlobalProtect portal but receives 'Certificate validation failed'. What is the most likely missing configuration?

Accepted Answer

The root CA certificate is not imported into the firewall. For certificate-based client authentication, the firewall needs the root CA certificate of the client certificates imported; otherwise, it cannot validate the client certs.

Answer

The gateway's certificate is not configured

Answer

The user's client certificate is expired

Answer

The portal's certificate is not configured

Question 10

Which TWO features are exclusive to GlobalProtect gateway configurations and not available on the portal?

Accepted Answer

Enforcement of host integrity checks.. Host integrity checks and internal gateway configuration for split tunneling are configured only on the gateway, not on the portal.

Answer

Clientless VPN access.

Answer

Application override settings.

Answer

Use of SSL as a transport protocol.

PCNSE Practice Test 10 — 10 Questions

Exhibit

PCNSE Practice Test 10 — 10 Questions

Exhibit