PCNSE Secure Access and VPN Practice Test 2 — 15 Questions

Question 1

A company wants to provide VPN access to external business partners who do not have the GlobalProtect client installed. Which VPN method should be used?

Accepted Answer

SSL VPN (clientless). SSL VPN (clientless) is correct because it allows external business partners to access specific web-based applications or internal resources through a standard web browser without requiring any client software installation. This method uses HTTPS and SSL/TLS to encrypt the session, making it ideal for scenarios where the remote user cannot or will not install the GlobalProtect client.

Answer

GlobalProtect with pre-logon

Answer

IPSec VPN

Answer

L2TP over IPSec

Question 2

An organization uses RADIUS as the primary authentication method for GlobalProtect with One-Time Password (OTP). Users can authenticate to the portal, but the gateway connection fails. The RADIUS server logs show successful authentication. What is the most likely issue?

Accepted Answer

The gateway is not configured to use RADIUS. When RADIUS is used for GlobalProtect with OTP, the portal and gateway each require their own authentication profile configuration. Successful portal authentication but gateway failure indicates the gateway lacks a RADIUS authentication profile or is misconfigured, even though the RADIUS server logs show success for the portal. Option D is correct because the gateway must be explicitly configured to use RADIUS; otherwise, it cannot process the authentication response.

Answer

The portal's authentication profile does not pass the OTP to the gateway

Answer

The RADIUS server does not return a session timeout

Answer

The firewall is not configured to allow RADIUS traffic

Question 3

Which THREE of the following are valid configuration elements for a tunnel interface in Palo Alto Networks?

Accepted Answer

Zone. Option A (Zone) is correct because a tunnel interface must be assigned to a security zone so that security policy, routing, and zone-based protection can be applied to traffic traversing the tunnel. Option B (IP address) is correct because a tunnel interface requires an IP address (or at least an IP configuration such as an unnumbered/DHCP-assigned address) to participate in routing and to source tunnel traffic. Option D (Management Profile) is correct because a tunnel interface supports a management profile, which controls which management services (e.g., HTTPS, SSH, SNMP, ping) are permitted on that interface. Option C (Traffic shaping policy) is not a tunnel interface configuration element; QoS/traffic shaping is configured separately via QoS profiles and policies applied to interfaces or security rules. Option E (Netflow profile) is not a tunnel interface setting; NetFlow export is configured through a NetFlow profile applied to a zone or interface in a different context, not as a tunnel interface parameter.

Answer

Traffic shaping policy

Answer

Netflow profile

Question 4

What is the most likely cause of Phase2 being down?

Accepted Answer

Mismatched IPSec encryption or authentication settings. Phase 2 of an IPsec VPN tunnel establishes the IPsec security associations (SAs) for encrypting and authenticating data traffic. If the Phase 2 parameters, such as encryption algorithm (e.g., AES-256 vs. AES-128), authentication algorithm (e.g., SHA-256 vs. SHA-1), or DH group (e.g., group 14 vs. group 2), do not match between peers, the IKEv2 or IKEv1 Quick Mode negotiation will fail, leaving Phase 2 down. This is the most common cause of a successful Phase 1 (IKE SA) but a failed Phase 2.

Answer

Mismatched IKE version

Answer

Wrong tunnel interface IP address

Answer

Incorrect pre-shared key

Question 5

A user tries to connect to the GlobalProtect portal but receives 'Certificate validation failed'. What is the most likely missing configuration?

Accepted Answer

The portal's certificate is not configured. The 'Certificate validation failed' error occurs because the GlobalProtect portal does not have a valid certificate configured, or the client does not trust the certificate authority (CA) that signed the portal's certificate. The portal must present a certificate that the client can validate; if the portal's certificate is not configured or is self-signed without proper trust, the client cannot establish trust. Importing the root CA certificate on the firewall is for client certificate authentication, not for server certificate validation.

Answer

The root CA certificate is not imported into the firewall

Answer

The gateway's certificate is not configured

Answer

The user's client certificate is expired

Question 6

A GlobalProtect user behind the tunnel is unable to browse HTTPS websites. What is the issue?

Accepted Answer

The tunnel inspection required conflicts with the no-decrypt rule, causing SSL sessions to be dropped. When a GlobalProtect tunnel is established, the firewall applies tunnel inspection to decrypt and inspect traffic inside the tunnel. If a no-decrypt rule exists (e.g., for certain traffic or users), it conflicts with the tunnel inspection requirement, causing the firewall to drop SSL sessions because it cannot both inspect and bypass decryption. This results in HTTPS websites being unreachable for the user behind the tunnel.

Answer

The firewall's decryption policy is not applied to the tunnel

Answer

The decryption policy rule blocks traffic from 10.0.0.0/8

Answer

The user's SSL certificate is not trusted

Question 7

A network administrator configures GlobalProtect for remote users. Users report they can connect but cannot access internal resources. The firewall shows the user is connected with a valid IP. What is the most likely cause?

Accepted Answer

Split tunneling is misconfigured, causing missing internal routes.. When GlobalProtect users can connect and obtain a valid IP but cannot access internal resources, the most common cause is misconfigured split tunneling. If split tunneling is not properly set to route internal traffic through the VPN tunnel, the client may not have the necessary routes for internal subnets, causing traffic to be sent directly to the internet instead of through the firewall. This results in connectivity to the gateway but failure to reach internal resources.

Answer

The client's local firewall is blocking traffic.

Answer

The GlobalProtect gateway is not configured with the correct internal DNS suffix.

Answer

The authentication profile is set to require multi-factor authentication.

Question 8

A company integrates GlobalProtect with SAML for SSO. Users report that after authentication, they receive a 'Portal cannot be reached' error. The firewall logs show the SAML authentication succeeded. What should the administrator check?

Accepted Answer

The SSL/TLS service profile on the portal is not bound to the correct certificate.. The 'Portal cannot be reached' error after successful SAML authentication indicates the browser cannot establish a trusted SSL/TLS connection to the portal. The SAML authentication succeeded, so the issue is not with the SAML profile or certificate. The SSL/TLS service profile on the portal must be bound to a certificate that matches the portal's FQDN and is trusted by the client browser; otherwise, the browser will block the connection, causing this error.

Answer

The user's browser is blocking pop-ups from the portal.

Answer

The GlobalProtect portal agent is not set to use the correct SAML profile.

Answer

The SAML identity provider's certificate is not imported on the firewall.

Question 9

Refer to the exhibit. A firewall administrator configures an IPSec tunnel. After committing, the tunnel never becomes active. What is the most likely reason?

Accepted Answer

The IKE gateway configuration is missing.. B is correct because an IPSec tunnel requires both an IKE gateway configuration and an IPSec crypto profile to establish Phase 1 and Phase 2 security associations. Without the IKE gateway, the firewall has no peer address, authentication method, or pre-shared key to initiate IKEv1/v2 exchanges, so the tunnel remains down. The exhibit likely shows a tunnel interface and crypto profile but omits the IKE gateway object, which is mandatory for tunnel activation.

Answer

The tunnel interface is not in a zone.

Answer

The proxy-id protocol should be set to '0' for all.

Answer

The crypto profile name is invalid.

Question 10

Refer to the exhibit. A firewall log shows these messages for an IPSec tunnel. Which configuration mismatch is the likely cause?

Accepted Answer

IKE Phase 2 proposal mismatch.. The log messages indicate that IKE Phase 1 completed successfully (as shown by the 'IKE Phase 1 established' message), but Phase 2 negotiation failed. This points directly to a mismatch in the IKE Phase 2 proposal parameters, such as the IPsec security protocol (ESP vs AH), encryption algorithm, authentication algorithm, or Diffie-Hellman group used for PFS. A Phase 2 proposal mismatch prevents the creation of the IPsec SA, even though the IKE SA is already established.

Answer

IKE Phase 1 proposal mismatch.

Answer

Preshared key mismatch.

Answer

Invalid peer IP address.

Question 11

Which TWO conditions are required for a successful GlobalProtect connection using certificate authentication?

Accepted Answer

The client certificate must be issued by a CA trusted by the firewall.. Option A is correct because for certificate-based authentication the firewall validates the client certificate against a Certificate Authority in its trusted CA list, so the issuing CA must be trusted by the firewall or the certificate chain will fail validation. Option B is correct because the GlobalProtect portal (and gateway) must present a server certificate for the SSL/TLS handshake; without a valid portal certificate, clients cannot establish the HTTPS connection to the portal to begin authentication. Option C is incorrect because it is the client that needs to trust the portal's server certificate, not the browser needing the firewall's root CA for client authentication. Option D is incorrect because the firewall does not need the client's public key stored locally; it validates the client certificate presented during the TLS handshake against trusted CAs. Option E is incorrect because certificate authentication replaces username/password credentials, so a valid username and password is not required for this method.

Answer

The user's browser must have the firewall's root CA certificate.

Answer

The firewall must have the client certificate's public key.

Answer

The client must have a valid username and password.

Question 12

Which TWO features are exclusive to GlobalProtect gateway configurations and not available on the portal?

Accepted Answer

Enforcement of host integrity checks.. Option B is correct because Host Information Profile (HIP) enforcement — the host integrity checks that verify a client's patch level, antivirus, and other security posture before granting access — is configured and applied on the GlobalProtect gateway, not the portal; the portal only distributes the HIP profile/agent config, while the gateway enforces the HIP policy. Option C is correct because the internal gateway and its split-tunneling behavior (which traffic is routed through the tunnel versus sent directly to the internet) are defined in the gateway configuration, since the gateway is the endpoint that establishes the tunnel and applies the split-tunnel network access routes. Option A is not exclusive to the gateway: Clientless VPN is a portal-based feature that provides browser-based access to internal applications without the GlobalProtect agent. Option D is not exclusive to the gateway: application override settings are part of the firewall's App-ID/security policy configuration and are not a gateway-only capability. Option E is not exclusive to the gateway: both the portal and the gateway use SSL/TLS as a transport protocol for their communications.

Answer

Clientless VPN access.

Answer

Application override settings.

Answer

Use of SSL as a transport protocol.

Question 13

A remote user's GlobalProtect client disconnects every 10 minutes. What setting should the administrator check?

Accepted Answer

The ping interval on the gateway.. The GlobalProtect client uses a keepalive mechanism to maintain the VPN tunnel. The ping interval on the gateway determines how often the client sends ICMP echo requests to the gateway to verify connectivity. If the ping interval is set too high or the client fails to receive responses within the configured timeout, the client may interpret the connection as lost and disconnect. A 10-minute disconnection pattern strongly suggests the ping interval or related timeout is misconfigured, causing the client to drop the tunnel after a period of inactivity.

Answer

The reconnection interval on the portal.

Answer

The idle timeout on the authentication profile.

Answer

The UDP checksum offloading on the client.

Question 14

A company uses GlobalProtect with internal gateways for accessing data center resources. Users on the internal network should not use the VPN. What is the best practice configuration?

Accepted Answer

Use the Internal Gateway with a pre-logon check.. Using an Internal Gateway with a pre-logon check allows the GlobalProtect agent to detect that the user is on the internal network and skip the VPN tunnel, while still enforcing security policies. This configuration ensures that internal users do not route traffic through the VPN, avoiding unnecessary overhead and potential routing issues, while the pre-logon check verifies the user's identity before granting access to data center resources.

Answer

Use the same portal for both internal and external with a single gateway.

Answer

Set the gateway to require internal client detection via IP range exclusion.

Answer

Disable the GlobalProtect agent for internal IP ranges.

Question 15

During a security audit, it is discovered that the GlobalProtect gateway allows clients to use weak encryption algorithms. Which configuration object controls this?

Accepted Answer

The IPSec crypto profile associated with the gateway.. The GlobalProtect gateway uses IPSec to secure VPN tunnels between clients and the gateway. The IPSec crypto profile defines the encryption algorithms, authentication methods, and key exchange parameters for these tunnels. If weak encryption algorithms are allowed, it is because the IPSec crypto profile associated with the gateway is configured with those weak options.

Answer

The SSL/TLS service profile on the gateway.

Answer

The GlobalProtect portal agent configuration.

Answer

The SSL/SSH service profile on the firewall.