PCNSE Secure Access and VPN Practice Test 2 — 15 Questions

Question 1

Match each security rule action to its effect.

Accepted Answer

Allow: Permits traffic to pass through the firewall.. Correct matches: Allow permits traffic; Deny blocks and sends TCP reset. Drop silently blocks traffic. Common confusion is between Deny and Drop.

Answer

Allow: Blocks traffic and sends a TCP reset to the source.

Answer

Deny: Silently drops traffic without any notification.

Question 2

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

Accepted Answer

Incorrect gateway IP address in portal configuration. When the portal and gateway are on the same firewall, the portal configuration must specify the correct IP address or FQDN for the gateway. If the gateway IP address in the portal configuration is incorrect, the client will successfully authenticate to the portal but then fail to establish a tunnel to the gateway because it cannot reach the gateway at the specified address. This is the most common cause of this symptom.

Answer

User not assigned a license

Answer

Gateway interface not in the same zone as portal

Answer

Gateway MTU mismatch

Question 3

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

Accepted Answer

debug ike global on. 'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Answer

show counter global | match ipsec

Answer

show log system

Answer

debug flow basic

Question 4

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

Accepted Answer

The gateway's 'Allow Access' list does not include the user. After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.

Answer

The user's GlobalProtect client software is outdated

Answer

The gateway's interface is not in the same zone as the portal

Answer

The portal's 'Access' list does not include the user

Question 5

When configuring GlobalProtect with certificate authentication, a user reports that the client prompts for username and password even though the certificate is installed. What is the most likely cause?

Accepted Answer

The portal authentication profile requires both certificate and password. When a GlobalProtect portal authentication profile is configured to require both certificate and password, the client will prompt for username and password even if a valid certificate is present. This is because the authentication profile explicitly enforces multi-factor authentication, meaning the certificate alone is insufficient for portal authentication. The client must satisfy all configured authentication factors before proceeding.

Answer

The certificate is expired

Answer

The client certificate does not match the username

Answer

The root CA certificate is not imported into the firewall

Question 6

A network engineer configures a tunnel interface for IPSec VPN. After committing, the interface is up but no traffic passes. The tunnel itself is established (IKEv2). What should the engineer check first?

Accepted Answer

The tunnel interface has no IP address. For an IPSec tunnel interface to pass traffic, it must have an IP address assigned. Without an IP address, the tunnel interface cannot participate in routing, and the firewall will not forward packets into or out of the tunnel, even though the IKEv2 security associations are established. The IP address is required for the tunnel to be a valid next-hop in the routing table.

Answer

The tunnel interface is in the wrong virtual router

Answer

The tunnel interface is not assigned to a zone

Answer

The tunnel interface does not have a management profile

Question 7

A company wants to use GlobalProtect with pre-logon (user unknown). After configuration, users report that they can authenticate but cannot access the gateway during pre-logon. Which configuration item is most likely missing?

Accepted Answer

Gateway's certificate not imported or untrusted. During pre-logon, the GlobalProtect gateway must present a trusted certificate to the client before any user authentication occurs, because the user is unknown and the client cannot rely on user credentials to validate the gateway. If the gateway's certificate is not imported or is untrusted, the client will reject the SSL/TLS handshake, preventing access even though portal authentication succeeds. This is the most common cause of pre-logon connectivity failure after portal authentication works.

Answer

Pre-logon token not enabled on the portal

Answer

Pre-logon token not enabled on the gateway

Answer

Portal's authentication profile does not allow pre-logon

Question 8

A company wants to provide VPN access to external business partners who do not have the GlobalProtect client installed. Which VPN method should be used?

Accepted Answer

SSL VPN (clientless). SSL VPN (clientless) is correct because it allows external business partners to access specific web-based applications or internal resources through a standard web browser without requiring any client software installation. This method uses HTTPS and SSL/TLS to encrypt the session, making it ideal for scenarios where the remote user cannot or will not install the GlobalProtect client.

Answer

GlobalProtect with pre-logon

Answer

IPSec VPN

Answer

L2TP over IPSec

Question 9

An organization uses RADIUS as the primary authentication method for GlobalProtect with One-Time Password (OTP). Users can authenticate to the portal, but the gateway connection fails. The RADIUS server logs show successful authentication. What is the most likely issue?

Accepted Answer

The gateway is not configured to use RADIUS. When RADIUS is used for GlobalProtect with OTP, the portal and gateway each require their own authentication profile configuration. Successful portal authentication but gateway failure indicates the gateway lacks a RADIUS authentication profile or is misconfigured, even though the RADIUS server logs show success for the portal. Option D is correct because the gateway must be explicitly configured to use RADIUS; otherwise, it cannot process the authentication response.

Answer

The portal's authentication profile does not pass the OTP to the gateway

Answer

The RADIUS server does not return a session timeout

Answer

The firewall is not configured to allow RADIUS traffic

Question 10

Which TWO of the following are supported authentication methods for IPSec VPN tunnel setup between two Palo Alto Networks firewalls?

Accepted Answer

Certificate. Palo Alto Networks firewalls support certificate-based authentication for IKEv1 and IKEv2 IPsec VPN tunnels, where each peer presents an X.509 certificate signed by a trusted CA. This method provides strong mutual authentication and is commonly used in large-scale or high-security deployments.

Answer

RADIUS

Answer

SAML

Answer

LDAP

Question 11

Which THREE of the following are valid configuration elements for a tunnel interface in Palo Alto Networks?

Accepted Answer

Zone. Every tunnel interface in Palo Alto Networks must be assigned to a security zone. The zone determines which security policies apply to traffic entering or leaving the tunnel, and without a zone assignment, the tunnel interface cannot pass traffic. This is a mandatory configuration element for any Layer 3 interface, including tunnel interfaces.

Answer

Traffic shaping policy

Answer

Netflow profile

Question 12

Which THREE of the following are capabilities of GlobalProtect Host Information Profile (HIP)?

Accepted Answer

Check if antivirus is installed and running. GlobalProtect Host Information Profile (HIP) is designed to collect endpoint security posture data, such as antivirus status, disk encryption status, and operating system version. Option C is correct because HIP can check whether antivirus software is both installed and actively running, which is a standard HIP check for compliance.

Answer

Check the user's location

Answer

Check the browser version

Question 13

What is the most likely cause of Phase2 being down?

Accepted Answer

Mismatched IPSec encryption or authentication settings. Phase 2 of an IPsec VPN tunnel establishes the IPsec security associations (SAs) for encrypting and authenticating data traffic. If the Phase 2 parameters, such as encryption algorithm (e.g., AES-256 vs. AES-128), authentication algorithm (e.g., SHA-256 vs. SHA-1), or DH group (e.g., group 14 vs. group 2), do not match between peers, the IKEv2 or IKEv1 Quick Mode negotiation will fail, leaving Phase 2 down. This is the most common cause of a successful Phase 1 (IKE SA) but a failed Phase 2.

Answer

Mismatched IKE version

Answer

Wrong tunnel interface IP address

Answer

Incorrect pre-shared key

Question 14

A user tries to connect to the GlobalProtect portal but receives 'Certificate validation failed'. What is the most likely missing configuration?

Accepted Answer

The portal's certificate is not configured. The 'Certificate validation failed' error occurs because the GlobalProtect portal does not have a valid certificate configured, or the client does not trust the certificate authority (CA) that signed the portal's certificate. The portal must present a certificate that the client can validate; if the portal's certificate is not configured or is self-signed without proper trust, the client cannot establish trust. Importing the root CA certificate on the firewall is for client certificate authentication, not for server certificate validation.

Answer

The root CA certificate is not imported into the firewall

Answer

The gateway's certificate is not configured

Answer

The user's client certificate is expired

Question 15

A GlobalProtect user behind the tunnel is unable to browse HTTPS websites. What is the issue?

Accepted Answer

The tunnel inspection required conflicts with the no-decrypt rule, causing SSL sessions to be dropped. When a GlobalProtect tunnel is established, the firewall applies tunnel inspection to decrypt and inspect traffic inside the tunnel. If a no-decrypt rule exists (e.g., for certain traffic or users), it conflicts with the tunnel inspection requirement, causing the firewall to drop SSL sessions because it cannot both inspect and bypass decryption. This results in HTTPS websites being unreachable for the user behind the tunnel.

Answer

The firewall's decryption policy is not applied to the tunnel

Answer

The decryption policy rule blocks traffic from 10.0.0.0/8

Answer

The user's SSL certificate is not trusted