PCNSE Secure Access and VPN Practice Test 3 — 15 Questions

Question 1

A company wants to deploy GlobalProtect to 10,000 remote users. Which method provides the most scalable and automated distribution of the client software?

Accepted Answer

Web-based download from the portal.. Web-based download from the portal is the most scalable and automated method because GlobalProtect portals can host the client installer and automatically push it to users when they authenticate. This eliminates manual intervention, supports thousands of concurrent downloads, and integrates with the portal's auto-update mechanism to ensure all remote users run the latest version without IT overhead.

Answer

Manual installation via USB.

Answer

Email attachment.

Answer

Group Policy deployment via Active Directory.

Question 2

A network engineer configures an IPSec tunnel with multiple proxy IDs for different subnets. After committing, only one proxy ID establishes IPsec SAs. What should the engineer check?

Accepted Answer

The number of concurrent tunnels allowed.. Palo Alto Networks firewalls have a default limit on the number of concurrent IPsec tunnels. When multiple proxy IDs are configured, each proxy ID requires its own IPsec security association (SA). If the tunnel limit is reached, only the first proxy ID establishes SAs, and subsequent ones fail. Checking and increasing the 'Number of Tunnels' setting under the tunnel interface or global IPSec configuration resolves this.

Answer

The IPSec crypto profile.

Answer

The IKE gateway mode.

Answer

The tunnel monitor settings.

Question 3

An administrator configures a VPN tunnel between two Palo Alto firewalls. The tunnel shows as active, but traffic is not being encrypted. What configuration step is most likely missing?

Accepted Answer

A security policy allowing traffic from the tunnel interface to the destination.. Even when a VPN tunnel is active (Phase 1 and Phase 2 SAs are established), traffic will not be encrypted unless a security policy explicitly permits traffic from the tunnel interface to the destination zone. On Palo Alto firewalls, inter-zone traffic requires a security policy to allow the session; without it, the firewall drops the traffic before it can be encrypted and sent over the tunnel. The tunnel being up only indicates IKE/IPsec negotiation succeeded, not that data-plane forwarding is authorized.

Answer

The encryption algorithm must be set to null.

Answer

A NAT policy to translate private addresses.

Answer

The tunnel interface must be assigned to a security zone.

Question 4

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Accepted Answer

Enable Automatic Tunnel. Option B (Enable Automatic Tunnel) is correct because the portal's agent configuration must have the Automatic Tunnel setting enabled so that macOS endpoints automatically establish the tunnel without user interaction, which is the core requirement for automatic tunnel configuration. Option E (Specify a Tunnel Interface) is correct because the portal agent configuration must reference a tunnel interface (e.g., tunnel.1) so the GlobalProtect app knows which interface to use for the automatic tunnel on macOS clients. Option A is not required for automatic tunnel configuration itself; assigning a client package only controls which GlobalProtect app version is deployed. Option C is incorrect because a Gateway IP Pool is configured on the gateway for assigning client IP addresses, not on the portal to enable automatic tunneling. Option D is incorrect because PanGPS is the GlobalProtect service that runs on the endpoint and is not a portal configuration setting.

Answer

GlobalProtect client package assigned to macOS

Answer

Gateway IP Pool configured

Answer

PanGPS (Pan GlobalProtect Service) enabled

Question 5

A small company has two sites connected by a policy-based IPsec VPN. Users at Site B report they cannot reach a server at Site A with IP 10.1.1.100. The firewall administrator checks the VPN monitor and sees the tunnel is active and IKE SAs are up. From the Site B firewall, a ping to 10.1.1.100 succeeds. However, a user on a PC (192.168.50.10) behind the Site B firewall cannot ping 10.1.1.100. The security policy on the Site B firewall allows traffic from trust to VPN zones. What is the most likely cause of the issue?

Accepted Answer

The security policy on Site B does not include the user subnet as a source VPN zone traffic. The security policy on Site B must explicitly include the user subnet (192.168.50.0/24) as a source in the rule that permits traffic to the VPN zone. Even though the tunnel is up and the firewall itself can reach 10.1.1.100 (bypassing policy checks), user traffic is subject to security rules. Without the user subnet as a source, the policy drops the traffic, causing the connectivity failure.

Answer

NAT is translating the user's IP to an incorrect address

Answer

The IPsec tunnel has a misconfigured proxy ID

Answer

The Site A firewall has a route missing for the Site B user subnet

Question 6

A large organization uses GlobalProtect for remote access. Recently, users in the APAC region have been reporting frequent disconnections from the VPN. They can connect and authenticate, but after about 5 minutes the session drops and they must reconnect. The firewall logs show 'GlobalProtect gateway timeout' for these users. The gateway's tunnel timeout is set to 30 minutes. What is the most likely cause?

Accepted Answer

The GlobalProtect client's keepalive interval is set to 60 minutes. The GlobalProtect client uses keepalive messages to maintain the tunnel with the gateway. If the keepalive interval (default 60 minutes) exceeds the gateway's tunnel timeout (30 minutes), the gateway will tear down the idle tunnel before the client sends its next keepalive, causing a 'GlobalProtect gateway timeout' and disconnection after approximately 5 minutes (the gateway's idle timeout for the tunnel). The client must reconnect because the gateway considers the session expired.

Answer

The portal's authentication timeout is set to 120 minutes

Answer

The IP pool for the gateway is exhausted

Answer

The internal gateway hostname cannot be resolved by the client

Question 7

After upgrading a firewall pair from PAN-OS 9.1 to 10.0, a route-based IPsec VPN to a partner is no longer establishing. The tunnel is configured with a tunnel interface (tunnel.1) with IP 10.0.0.1/30 and the remote tunnel interface is 10.0.0.2/30. IKE phase 1 completes successfully, but phase 2 fails with 'no proposal chosen' on both sides. Both firewalls have identical IPsec crypto profiles (ESP-AES-256, SHA-256, DH-5, 1-hour lifetime). What is the most likely cause?

Accepted Answer

The proxy ID configuration was removed during the upgrade. During a PAN-OS upgrade, proxy ID configurations for route-based IPsec VPNs can be lost or reset to default values. Since the tunnel uses a numbered tunnel interface (10.0.0.1/30), the firewall automatically generates proxy IDs based on the tunnel interface IP and remote tunnel interface IP. If the proxy IDs are missing or mismatched after the upgrade, Phase 2 fails with 'no proposal chosen' even though the crypto profiles match. The fix is to verify and reconfigure the proxy IDs under the IPsec tunnel configuration.

Answer

The tunnel interface IP address conflicts with another interface

Answer

The new PAN-OS version requires a stronger DH group for IPsec

Answer

A security policy block IKE is blocking the tunnel

Question 8

A multinational corporation uses GlobalProtect with multiple gateways distributed globally for load balancing. The portal has 'Enable Location Awareness' enabled and region mapping is configured to map APAC users to the APAC gateway, US users to the US gateway, etc. Recently, users in the APAC region are being redirected to the US gateway, causing high latency. The AD admin confirms that users are in the correct APAC subnets. What is the most likely misconfiguration?

Accepted Answer

The location awareness database is outdated for APAC IP subnets. The portal uses a location awareness database to map client IP addresses to geographic regions. If this database is outdated for APAC IP subnets, the portal may fail to recognize APAC users correctly and redirect them to the US gateway, causing high latency. The AD admin confirms the users are in correct APAC subnets, ruling out a client-side subnet issue, so the most likely cause is a stale or incorrect location database on the portal.

Answer

The APAC gateway's region mapping is configured with incorrect IP subnets

Answer

The APAC gateway's IP pool is exhausted

Answer

The portal's 'Primary Gateway' is set to the US gateway

Question 9

A remote user reports they cannot connect to the corporate network via GlobalProtect. The GlobalProtect client shows 'Connection failed. Unable to establish a secure connection.' The portal and gateway are configured with certificate authentication. The administrator verifies that the portal/gateway certificates are valid and not expired, and the common name matches the portal's FQDN. The client's machine time is synchronized. Which configuration misconfiguration is most likely the cause?

Accepted Answer

The client's GlobalProtect app is an older version that does not support TLS 1.2.. The error 'Unable to establish a secure connection' indicates a TLS handshake failure. If the GlobalProtect client is an older version that does not support TLS 1.2, but the portal/gateway requires TLS 1.2 (as is common in modern PAN-OS configurations), the handshake will fail even though certificates are valid and time is synchronized. This is a classic version incompatibility issue where the client cannot negotiate a mutually supported TLS protocol version.

Answer

The gateway authentication profile is set to use RADIUS instead of certificate.

Answer

The portal is configured with an incorrect server certificate common name (CN) that does not match the portal's FQDN.

Answer

The GlobalProtect gateway is configured to require HIP match, but the user's endpoint does not meet the HIP profile.

Question 10

A network engineer is configuring a new GlobalProtect gateway to provide remote access. Which TWO items are required for the gateway to function properly?

Accepted Answer

A certificate for the gateway. Option A is correct because a GlobalProtect gateway must present a server certificate to establish the SSL/TLS connection with GlobalProtect agents, and this certificate is bound to the gateway interface used for portal/gateway communication. Option C is correct because the gateway needs an IP pool (client IP address pool) to assign virtual IP addresses to connecting clients so their traffic can be routed and secured through the tunnel. Option B is not required at the gateway level for basic functionality, since authentication profiles are typically configured on the portal (and optionally the gateway), but the question asks for items required for the gateway itself to function. Option D is not required; split tunneling is an optional configuration that controls which traffic is tunneled versus sent directly. Option E is not required because clientless VPN is a separate feature for browser-based access and is not needed for standard GlobalProtect agent-based remote access.

Answer

An authentication profile

Answer

A split tunneling configuration

Answer

A clientless VPN configuration

Question 11

A site-to-site IPsec tunnel between two Palo Alto Networks firewalls is not passing traffic. The administrator runs the 'show vpn ipsec-sa' command and sees the output in the exhibit. The remote peer is configured to use IKEv2 only. Based on the configuration, what is the most likely cause of the tunnel being in 'init' state?

Accepted Answer

The IKE version is incompatible.. The 'init' state in the 'show vpn ipsec-sa' output indicates that the IPsec Security Association (SA) has not been established because the IKE phase 1 negotiation failed. Since the remote peer is configured to use IKEv2 only, and the local firewall is likely configured for IKEv1 (or both, but not matching), the IKE version mismatch prevents the initial key exchange. This is the most direct cause of the tunnel remaining in 'init' state.

Answer

The pre-shared key is incorrect.

Answer

The proxy IDs are mismatched with the peer.

Answer

The IPsec crypto profile lifetime is too short.

Question 12

A network engineer is configuring a route-based IPsec VPN tunnel between two Palo Alto Networks firewalls. The engineer wants to ensure that the tunnel interface is always up and that traffic is routed through the tunnel even when no interesting traffic is present. Which configuration is required to achieve this?

Accepted Answer

Enable 'Tunnel Monitor' on the tunnel interface and configure a static route to the remote network via the tunnel.. In a route-based VPN, the tunnel interface must be up for traffic to flow. Enabling Tunnel Monitor on the tunnel interface causes the firewall to send ICMP probes to a target IP address through the tunnel, which generates traffic and keeps the IPsec SA active. A static route directs traffic to the tunnel interface.

Answer

Set the tunnel interface to 'passive' mode and configure a default route to the tunnel.

Answer

Configure a static route to the remote network via the tunnel interface and define proxy IDs.

Answer

Enable 'Monitor' on the tunnel interface and configure a static route to the tunnel.

Question 13

A company has deployed GlobalProtect with a portal and two gateways. Users report that they can connect to the portal but cannot establish a tunnel to any gateway. The administrator checks the gateway configuration and sees that the gateway is configured with a certificate for its external interface. The portal is configured to use the same certificate. What is the most likely cause of the issue?

Accepted Answer

The gateway's authentication profile is misconfigured or missing.. The gateway must have an authentication profile to authenticate users when they attempt to connect. If the gateway's authentication profile is missing or misconfigured, users can authenticate to the portal but will fail to establish a tunnel to the gateway. This is a common misconfiguration when setting up GlobalProtect.

Answer

The gateway certificate is not trusted by the client.

Answer

The portal's authentication profile is not shared with the gateway.

Answer

The gateway is not configured with a proper interface or IP address.

Question 14

A network security engineer is configuring a new GlobalProtect gateway on a PA-5220 firewall running PAN-OS 10.2. The company wants to ensure that only clients with a valid client certificate issued by the internal PKI can establish a VPN connection. The engineer has already configured a certificate profile that references the internal CA and has attached it to the portal. Which additional step is required on the gateway to enforce certificate-based authentication for GlobalProtect clients?

Accepted Answer

Configure an authentication profile on the gateway that uses the certificate profile for client authentication.. To enforce certificate-based authentication at the GlobalProtect gateway, the gateway must use an authentication profile that includes the certificate profile. The certificate profile defines which CAs are trusted for client certificates, and the authentication profile applies it during the VPN authentication process. Other settings, such as portal agent configuration or SSL/TLS service profiles, do not control client certificate validation at the gateway level.

Answer

Enable 'Strict Certificate Validation' in the SSL/TLS service profile used by the gateway.

Answer

Enable the 'Require Client Certificate' option in the portal agent configuration.

Answer

Add the internal CA certificate to the trusted root CA list in the device certificate management settings.

Question 15

A network administrator is configuring a GlobalProtect portal and gateway on a Palo Alto Networks firewall. The company uses an external LDAP directory for user authentication. The administrator wants users to authenticate only once and have that session apply to both the portal and the gateway. Which GlobalProtect configuration should the administrator implement to achieve this?

Accepted Answer

Configure the portal to use LDAP authentication and enable 'Authentication Override' with a certificate for the gateway.. To achieve a single authentication for both portal and gateway with LDAP, the portal should authenticate the user and then use Authentication Override to issue a certificate that the GlobalProtect agent uses to authenticate to the gateway. This avoids a second credential prompt. The gateway must be configured to accept the override certificate, typically by enabling Authentication Override and specifying the same certificate profile used by the portal.

Answer

Use the same authentication profile on both the portal and gateway, and enable 'Single Sign-On' in the authentication profile.

Answer

Enable 'Cookie Authentication' on the portal and gateway, and set the same cookie name and key.

Answer

Configure the portal to use LDAP authentication and the gateway to use the same LDAP server, with 'Single Sign-On' enabled.