PCNSE Secure Access and VPN — 25 Questions

Question 1

An administrator sees the IPSec tunnel state 'down' under the tunnel monitor. What is the most common cause for this issue?

Accepted Answer

Incorrect pre-shared key. The most common cause for an IPsec tunnel showing 'down' in the tunnel monitor is an incorrect pre-shared key. During IKE Phase 1 authentication, both peers must present matching pre-shared keys; if they differ, the IKE SA negotiation fails, preventing the tunnel from coming up. This is a frequent misconfiguration because the key is manually entered and often mistyped or mismatched between endpoints.

Answer

Proxy ID mismatch

Answer

Tunnel interface IP misconfiguration

Answer

IKE version mismatch

Question 2

Refer to the exhibit. A firewall log shows these messages for an IPSec tunnel. Which configuration mismatch is the likely cause?

Accepted Answer

IKE Phase 2 proposal mismatch.. The log messages indicate that IKE Phase 1 completed successfully (as shown by the 'IKE Phase 1 established' message), but Phase 2 negotiation failed. This points directly to a mismatch in the IKE Phase 2 proposal parameters, such as the IPsec security protocol (ESP vs AH), encryption algorithm, authentication algorithm, or Diffie-Hellman group used for PFS. A Phase 2 proposal mismatch prevents the creation of the IPsec SA, even though the IKE SA is already established.

Answer

IKE Phase 1 proposal mismatch.

Answer

Preshared key mismatch.

Answer

Invalid peer IP address.

Question 3

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

Accepted Answer

The remote users' computers are not domain-joined.. Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Answer

The external gateway is not configured for Kerberos authentication.

Answer

The authentication profile is not configured on the gateway.

Answer

The GlobalProtect gateway certificate is not trusted by the client.

Question 4

A company is deploying GlobalProtect with internal gateways. They want to ensure that users who are inside the corporate network connect directly to internal resources without going through the firewall. Which configuration is required?

Accepted Answer

Set the portal's 'Internal Host Detection' to detect the internal network and set 'Gateway' to 'None' for the internal network.. GlobalProtect's Internal Host Detection (IHD) feature allows the portal to detect whether a user is inside the corporate network. When the portal detects the user is internal, it can be configured to assign 'None' as the gateway, meaning the client will not establish a VPN tunnel and will connect directly to internal resources. This ensures traffic does not hairpin through the firewall.

Answer

Configure the portal to assign the gateway only when the user is external.

Answer

Set the gateway's 'Tunnel Mode' to 'No' for internal users.

Answer

Configure the gateway agent with internal host detection.

Question 5

A firewall is configured with a GlobalProtect gateway that uses an IPSec tunnel. Remote users can connect but cannot access any resources. The administrator verifies that the tunnel is established and the client receives an IP address. What is the most likely cause?

Accepted Answer

The firewall does not have a route to the virtual IP pool.. When a GlobalProtect gateway uses an IPSec tunnel, the client receives an IP address from a virtual IP pool assigned to the tunnel interface. If the firewall lacks a route to that virtual IP pool, return traffic from internal resources cannot reach the client, even though the tunnel is established and the client has an IP. This is a common misconfiguration because the tunnel interface itself does not automatically inject a route for the pool into the virtual router.

Answer

The tunnel interface is not in a virtual router.

Answer

The security policy does not allow traffic from the VPN zone.

Answer

The IP pool for the VPN client is exhausted.

Question 6

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

Accepted Answer

The local and peer IP addresses are swapped on one side.. If the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Answer

The tunnel interface is not assigned to a security zone.

Answer

Dead peer detection (DPD) is not configured.

Answer

The MTU on the WAN interface is set too low.

Question 7

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 8

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

Accepted Answer

Configure a security policy with user-ID matching the required users.. The security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Answer

Use user-ID on the GlobalProtect gateway.

Answer

Configure group mapping on the GlobalProtect portal.

Answer

Create a HIP profile and assign it to the gateway.

Question 9

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.

Question 10

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Accepted Answer

Tunnel interface. A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Answer

Client certificate

Answer

Security zone for the tunnel interface

Answer

GlobalProtect portal configuration

Question 11

Which THREE are valid methods for configuring a site-to-site VPN on a Palo Alto Networks firewall?

Accepted Answer

Policy-based VPN using a tunnel monitor. A policy-based VPN on Palo Alto Networks uses a tunnel monitor to verify the health of the IPSec tunnel by sending ICMP probes to the peer's tunnel IP address. This allows the firewall to detect tunnel failures and trigger failover or route changes, which is a standard method for site-to-site VPN configuration.

Answer

GlobalProtect Gateway configuration

Answer

SSL VPN using GlobalProtect portal

Question 12

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 13

Refer to the exhibit. A user inside the corporate network (IP: 10.1.1.5) connects to the portal. The portal detects the internal host and does not assign a gateway. However, the user still cannot access internal resources. What is the most likely issue?

Accepted Answer

The GlobalProtect client is configured to always use the gateway.. When the GlobalProtect client is configured to 'always use the gateway,' it forces all traffic (including internal traffic) to be tunneled to the gateway even when the user is already inside the corporate network. The portal correctly detects the internal host and does not assign a gateway, but the client still attempts to send traffic through the gateway, which is not reachable or not configured to forward internal traffic back, breaking access to internal resources.

Answer

The gateway is not configured with a client IP pool.

Answer

The portal's authentication profile is incorrect.

Answer

The portal is not configured with internal host detection.

Question 14

A large enterprise uses a Palo Alto Networks firewall as the central hub for site-to-site VPN connections to 50 branch offices. Each branch office has a different subnet (e.g., 10.x.0.0/16 where x is the branch number). The VPN tunnels are configured using IKEv2 with pre-shared keys. Recently, the IT team decided to migrate to certificate-based authentication for improved security. They issued certificates from an internal CA to all branch firewalls and the hub firewall. After the migration, all tunnels failed to establish. The hub firewall logs show 'IKE negotiation failed' with error 'no proposal chosen'. The administrator checks the IKE gateway configuration on the hub: the IKE version is IKEv2, the authentication method is set to 'Certificate', and the certificate profile is configured with the root CA certificate. The administrator also verifies that the branch firewalls have the correct certificates and the hub's certificate is trusted. The branch firewalls' IKE gateways are configured with the hub's IP and pre-shared key (still configured as a fallback). What should the administrator do to resolve the issue?

Accepted Answer

Remove the pre-shared key from the IKE gateway configuration on the branch firewalls.. When using certificate-based authentication in IKEv2, the IKE gateway configuration must use only the certificate for authentication. If a pre-shared key is also configured, the firewall will attempt to use PSK authentication instead of the certificate, causing a mismatch with the peer expecting certificate-based authentication. This results in the 'no proposal chosen' error because the authentication method proposed (PSK) does not match the expected method (certificate). Removing the pre-shared key from the branch firewalls' IKE gateway configuration forces them to use the certificate, aligning with the hub's configuration.

Answer

Change the IKE version on the hub to IKEv1.

Answer

Reissue the hub firewall's certificate with the correct subject name.

Answer

Ensure the internal CA is reachable from the branch firewalls.

Question 15

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

Accepted Answer

Configure filter, Start capture, Generate traffic, Stop capture, Download. The correct sequence for packet capture on a Palo Alto Networks firewall is: first configure the capture filter to define which traffic to capture, then start the capture, generate the traffic, stop the capture to finalize the data, and finally download the capture file. This order ensures that the desired traffic is captured cleanly and the file is ready for analysis.

Answer

Start capture, Configure filter, Generate traffic, Stop capture, Download

Answer

Configure filter, Generate traffic, Start capture, Stop capture, Download

Answer

Configure filter, Start capture, Generate traffic, Download, Stop capture

Question 16

Match each security rule action to its effect.

Accepted Answer

Allow: Permits traffic to pass through the firewall.. Correct matches: Allow permits traffic; Deny blocks and sends TCP reset. Drop silently blocks traffic. Common confusion is between Deny and Drop.

Answer

Allow: Blocks traffic and sends a TCP reset to the source.

Answer

Deny: Silently drops traffic without any notification.

Question 17

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

Accepted Answer

Incorrect gateway IP address in portal configuration. When the portal and gateway are on the same firewall, the portal configuration must specify the correct IP address or FQDN for the gateway. If the gateway IP address in the portal configuration is incorrect, the client will successfully authenticate to the portal but then fail to establish a tunnel to the gateway because it cannot reach the gateway at the specified address. This is the most common cause of this symptom.

Answer

User not assigned a license

Answer

Gateway interface not in the same zone as portal

Answer

Gateway MTU mismatch

Question 18

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

Accepted Answer

debug ike global on. 'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Answer

show counter global | match ipsec

Answer

show log system

Answer

debug flow basic

Question 19

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

Accepted Answer

The gateway's 'Allow Access' list does not include the user. After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.

Answer

The user's GlobalProtect client software is outdated

Answer

The gateway's interface is not in the same zone as the portal

Answer

The portal's 'Access' list does not include the user

Question 20

When configuring GlobalProtect with certificate authentication, a user reports that the client prompts for username and password even though the certificate is installed. What is the most likely cause?

Accepted Answer

The portal authentication profile requires both certificate and password. When a GlobalProtect portal authentication profile is configured to require both certificate and password, the client will prompt for username and password even if a valid certificate is present. This is because the authentication profile explicitly enforces multi-factor authentication, meaning the certificate alone is insufficient for portal authentication. The client must satisfy all configured authentication factors before proceeding.

Answer

The certificate is expired

Answer

The client certificate does not match the username

Answer

The root CA certificate is not imported into the firewall