PCNSE Secure Access and VPN — 20 Questions

Question 1

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

Accepted Answer

The remote users' computers are not domain-joined.. Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Answer

The external gateway is not configured for Kerberos authentication.

Answer

The authentication profile is not configured on the gateway.

Answer

The GlobalProtect gateway certificate is not trusted by the client.

Question 2

A company is deploying GlobalProtect with internal gateways. They want to ensure that users who are inside the corporate network connect directly to internal resources without going through the firewall. Which configuration is required?

Accepted Answer

Set the portal's 'Internal Host Detection' to detect the internal network and set 'Gateway' to 'None' for the internal network.. GlobalProtect's Internal Host Detection (IHD) feature allows the portal to detect whether a user is inside the corporate network. When the portal detects the user is internal, it can be configured to assign 'None' as the gateway, meaning the client will not establish a VPN tunnel and will connect directly to internal resources. This ensures traffic does not hairpin through the firewall.

Answer

Configure the portal to assign the gateway only when the user is external.

Answer

Set the gateway's 'Tunnel Mode' to 'No' for internal users.

Answer

Configure the gateway agent with internal host detection.

Question 3

A firewall is configured with a GlobalProtect gateway that uses an IPSec tunnel. Remote users can connect but cannot access any resources. The administrator verifies that the tunnel is established and the client receives an IP address. What is the most likely cause?

Accepted Answer

The firewall does not have a route to the virtual IP pool.. When a GlobalProtect gateway uses an IPSec tunnel, the client receives an IP address from a virtual IP pool assigned to the tunnel interface. If the firewall lacks a route to that virtual IP pool, return traffic from internal resources cannot reach the client, even though the tunnel is established and the client has an IP. This is a common misconfiguration because the tunnel interface itself does not automatically inject a route for the pool into the virtual router.

Answer

The tunnel interface is not in a virtual router.

Answer

The security policy does not allow traffic from the VPN zone.

Answer

The IP pool for the VPN client is exhausted.

Question 4

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

Accepted Answer

The local and peer IP addresses are swapped on one side.. If the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Answer

The tunnel interface is not assigned to a security zone.

Answer

Dead peer detection (DPD) is not configured.

Answer

The MTU on the WAN interface is set too low.

Question 5

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 6

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

Accepted Answer

Configure a security policy with user-ID matching the required users.. The security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Answer

Use user-ID on the GlobalProtect gateway.

Answer

Configure group mapping on the GlobalProtect portal.

Answer

Create a HIP profile and assign it to the gateway.

Question 7

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Accepted Answer

Tunnel interface. Option C (Tunnel interface) is correct because the GlobalProtect gateway terminates the IPSec tunnel on a dedicated tunnel interface (a tunnel.1-style interface) that must be configured on the firewall for the tunnel to be established. Option E (IKE gateway configuration) is correct because IPSec tunnel negotiation requires an IKE gateway object defining the IKE version, peer addressing, and authentication/pre-shared key or certificate settings used in Phase 1. Option A is not required because client certificates are only needed when certificate-based authentication is chosen; user/pass or other auth methods can be used instead. Option B is not required because while the tunnel interface is typically bound to a zone, the zone assignment is a configuration detail of the tunnel interface rather than a separate mandatory element for tunnel establishment. Option D is not required because the GlobalProtect portal configuration is used for client configuration and agent deployment, not for establishing the IPSec tunnel itself.

Answer

Client certificate

Answer

Security zone for the tunnel interface

Answer

GlobalProtect portal configuration

Question 8

Which THREE are valid methods for configuring a site-to-site VPN on a Palo Alto Networks firewall?

Accepted Answer

Policy-based VPN using a tunnel monitor. Option A is correct because a policy-based VPN on a Palo Alto Networks firewall is configured by binding the IPSec tunnel to a security policy rule, and a tunnel monitor can be enabled on the IPSec tunnel to verify peer reachability and fail over. Option C is correct because a route-based VPN uses a tunnel interface placed in a zone, with a virtual router and a static route (or dynamic routing) directing traffic into the tunnel interface. Option E is correct because the tunnel interface is the logical construct that carries the IPSec tunnel, and the IPSec tunnel configuration (IKE gateway, IKE crypto profile, IPSec crypto profile) is applied to that tunnel interface. Option B is not correct because a GlobalProtect Gateway is for remote user/host VPN access, not site-to-site VPN. Option D is not correct because SSL VPN via GlobalProtect portal is also a remote-access VPN method, not a site-to-site VPN configuration.

Answer

GlobalProtect Gateway configuration

Answer

SSL VPN using GlobalProtect portal

Question 9

Refer to the exhibit. A user inside the corporate network (IP: 10.1.1.5) connects to the portal. The portal detects the internal host and does not assign a gateway. However, the user still cannot access internal resources. What is the most likely issue?

Accepted Answer

The GlobalProtect client is configured to always use the gateway.. When the GlobalProtect client is configured to 'always use the gateway,' it forces all traffic (including internal traffic) to be tunneled to the gateway even when the user is already inside the corporate network. The portal correctly detects the internal host and does not assign a gateway, but the client still attempts to send traffic through the gateway, which is not reachable or not configured to forward internal traffic back, breaking access to internal resources.

Answer

The gateway is not configured with a client IP pool.

Answer

The portal's authentication profile is incorrect.

Answer

The portal is not configured with internal host detection.

Question 10

A large enterprise uses a Palo Alto Networks firewall as the central hub for site-to-site VPN connections to 50 branch offices. Each branch office has a different subnet (e.g., 10.x.0.0/16 where x is the branch number). The VPN tunnels are configured using IKEv2 with pre-shared keys. Recently, the IT team decided to migrate to certificate-based authentication for improved security. They issued certificates from an internal CA to all branch firewalls and the hub firewall. After the migration, all tunnels failed to establish. The hub firewall logs show 'IKE negotiation failed' with error 'no proposal chosen'. The administrator checks the IKE gateway configuration on the hub: the IKE version is IKEv2, the authentication method is set to 'Certificate', and the certificate profile is configured with the root CA certificate. The administrator also verifies that the branch firewalls have the correct certificates and the hub's certificate is trusted. The branch firewalls' IKE gateways are configured with the hub's IP and pre-shared key (still configured as a fallback). What should the administrator do to resolve the issue?

Accepted Answer

Remove the pre-shared key from the IKE gateway configuration on the branch firewalls.. When using certificate-based authentication in IKEv2, the IKE gateway configuration must use only the certificate for authentication. If a pre-shared key is also configured, the firewall will attempt to use PSK authentication instead of the certificate, causing a mismatch with the peer expecting certificate-based authentication. This results in the 'no proposal chosen' error because the authentication method proposed (PSK) does not match the expected method (certificate). Removing the pre-shared key from the branch firewalls' IKE gateway configuration forces them to use the certificate, aligning with the hub's configuration.

Answer

Change the IKE version on the hub to IKEv1.

Answer

Reissue the hub firewall's certificate with the correct subject name.

Answer

Ensure the internal CA is reachable from the branch firewalls.

Question 11

Match each security rule action to its effect.

Accepted Answer

Allow: Permits traffic to pass through the firewall.. Correct matches: Allow permits traffic; Deny blocks and sends TCP reset. Drop silently blocks traffic. Common confusion is between Deny and Drop.

Answer

Allow: Blocks traffic and sends a TCP reset to the source.

Answer

Deny: Silently drops traffic without any notification.

Question 12

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

Accepted Answer

The gateway's 'Allow Access' list does not include the user. After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.

Answer

The user's GlobalProtect client software is outdated

Answer

The gateway's interface is not in the same zone as the portal

Answer

The portal's 'Access' list does not include the user

Question 13

A network engineer configures a tunnel interface for IPSec VPN. After committing, the interface is up but no traffic passes. The tunnel itself is established (IKEv2). What should the engineer check first?

Accepted Answer

The tunnel interface has no IP address. For an IPSec tunnel interface to pass traffic, it must have an IP address assigned. Without an IP address, the tunnel interface cannot participate in routing, and the firewall will not forward packets into or out of the tunnel, even though the IKEv2 security associations are established. The IP address is required for the tunnel to be a valid next-hop in the routing table.

Answer

The tunnel interface is in the wrong virtual router

Answer

The tunnel interface is not assigned to a zone

Answer

The tunnel interface does not have a management profile

Question 14

A company wants to use GlobalProtect with pre-logon (user unknown). After configuration, users report that they can authenticate but cannot access the gateway during pre-logon. Which configuration item is most likely missing?

Accepted Answer

Gateway's certificate not imported or untrusted. During pre-logon, the GlobalProtect gateway must present a trusted certificate to the client before any user authentication occurs, because the user is unknown and the client cannot rely on user credentials to validate the gateway. If the gateway's certificate is not imported or is untrusted, the client will reject the SSL/TLS handshake, preventing access even though portal authentication succeeds. This is the most common cause of pre-logon connectivity failure after portal authentication works.

Answer

Pre-logon token not enabled on the portal

Answer

Pre-logon token not enabled on the gateway

Answer

Portal's authentication profile does not allow pre-logon

Question 15

An administrator sees the IPSec tunnel state 'down' under the tunnel monitor. What is the most common cause for this issue?

Accepted Answer

Incorrect pre-shared key. The most common cause for an IPsec tunnel showing 'down' in the tunnel monitor is an incorrect pre-shared key. During IKE Phase 1 authentication, both peers must present matching pre-shared keys; if they differ, the IKE SA negotiation fails, preventing the tunnel from coming up. This is a frequent misconfiguration because the key is manually entered and often mistyped or mismatched between endpoints.

Answer

Proxy ID mismatch

Answer

Tunnel interface IP misconfiguration

Answer

IKE version mismatch

Question 16

A company wants to provide VPN access to external business partners who do not have the GlobalProtect client installed. Which VPN method should be used?

Accepted Answer

SSL VPN (clientless). SSL VPN (clientless) is correct because it allows external business partners to access specific web-based applications or internal resources through a standard web browser without requiring any client software installation. This method uses HTTPS and SSL/TLS to encrypt the session, making it ideal for scenarios where the remote user cannot or will not install the GlobalProtect client.

Answer

GlobalProtect with pre-logon

Answer

IPSec VPN

Answer

L2TP over IPSec

Question 17

An organization uses RADIUS as the primary authentication method for GlobalProtect with One-Time Password (OTP). Users can authenticate to the portal, but the gateway connection fails. The RADIUS server logs show successful authentication. What is the most likely issue?

Accepted Answer

The gateway is not configured to use RADIUS. When RADIUS is used for GlobalProtect with OTP, the portal and gateway each require their own authentication profile configuration. Successful portal authentication but gateway failure indicates the gateway lacks a RADIUS authentication profile or is misconfigured, even though the RADIUS server logs show success for the portal. Option D is correct because the gateway must be explicitly configured to use RADIUS; otherwise, it cannot process the authentication response.

Answer

The portal's authentication profile does not pass the OTP to the gateway

Answer

The RADIUS server does not return a session timeout

Answer

The firewall is not configured to allow RADIUS traffic

Question 18

Which THREE of the following are valid configuration elements for a tunnel interface in Palo Alto Networks?

Accepted Answer

Zone. Option A (Zone) is correct because a tunnel interface must be assigned to a security zone so that security policy, routing, and zone-based protection can be applied to traffic traversing the tunnel. Option B (IP address) is correct because a tunnel interface requires an IP address (or at least an IP configuration such as an unnumbered/DHCP-assigned address) to participate in routing and to source tunnel traffic. Option D (Management Profile) is correct because a tunnel interface supports a management profile, which controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface. Option C (Traffic shaping policy) is not a tunnel interface configuration element; QoS/traffic shaping is configured separately via QoS profiles and policies applied to interfaces or security rules. Option E (Netflow profile) is not a tunnel interface setting; NetFlow export is configured through a NetFlow profile applied to a zone or interface in a different context, not as a tunnel interface parameter.

Answer

Traffic shaping policy

Answer

Netflow profile

Question 19

What is the most likely cause of Phase2 being down?

Accepted Answer

Mismatched IPSec encryption or authentication settings. Phase 2 of an IPsec VPN tunnel establishes the IPsec security associations (SAs) for encrypting and authenticating data traffic. If the Phase 2 parameters, such as encryption algorithm (e.g., AES-256 vs. AES-128), authentication algorithm (e.g., SHA-256 vs. SHA-1), or DH group (e.g., group 14 vs. group 2), do not match between peers, the IKEv2 or IKEv1 Quick Mode negotiation will fail, leaving Phase 2 down. This is the most common cause of a successful Phase 1 (IKE SA) but a failed Phase 2.

Answer

Mismatched IKE version

Answer

Wrong tunnel interface IP address

Answer

Incorrect pre-shared key

Question 20

A user tries to connect to the GlobalProtect portal but receives 'Certificate validation failed'. What is the most likely missing configuration?

Accepted Answer

The portal's certificate is not configured. The 'Certificate validation failed' error occurs because the GlobalProtect portal does not have a valid certificate configured, or the client does not trust the certificate authority (CA) that signed the portal's certificate. The portal must present a certificate that the client can validate; if the portal's certificate is not configured or is self-signed without proper trust, the client cannot establish trust. Importing the root CA certificate on the firewall is for client certificate authentication, not for server certificate validation.

Answer

The root CA certificate is not imported into the firewall

Answer

The gateway's certificate is not configured

Answer

The user's client certificate is expired