PCNSE Secure Access and VPN Practice Test 3 — 15 Questions

Question 1

An organization has two sites connected via IPSec VPN. The tunnel is up, but ICMP traffic between sites fails. No other traffic works. The firewall policy allows any-any. What is the most likely issue?

Accepted Answer

The proxy IDs (interesting traffic) are not configured correctly.. Even if the tunnel is up, traffic might not be encapsulated if proxy IDs (interesting traffic) are mismatched, causing the firewall to drop or not encrypt traffic.

Answer

The IKE phase 1 proposal is mismatched.

Answer

The IPSec crypto profile uses AES-256 and the peer uses 3DES.

Answer

The tunnel interface MTU is set too low.

Question 2

A company integrates GlobalProtect with SAML for SSO. Users report that after authentication, they receive a 'Portal cannot be reached' error. The firewall logs show the SAML authentication succeeded. What should the administrator check?

Accepted Answer

The SSL/TLS service profile on the portal is not bound to the correct certificate.. After SAML authentication, the portal must present its web page over SSL. If the SSL/TLS service profile is not bound to the correct certificate, the browser may reject the connection.

Answer

The user's browser is blocking pop-ups from the portal.

Answer

The GlobalProtect portal agent is not set to use the correct SAML profile.

Answer

The SAML identity provider's certificate is not imported on the firewall.

Question 3

Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?

Accepted Answer

Multiple Phase 2 tunnels are established.. Multiple IKE SAs for the same peer typically indicate multiple Phase 2 tunnels (different proxy IDs) are established.

Answer

A configuration error causes duplicate SAs.

Answer

Multiple Phase 1 proposals are accepted.

Answer

The firewall is under DDoS attack.

Question 4

Refer to the exhibit. A firewall administrator configures an IPSec tunnel. After committing, the tunnel never becomes active. What is the most likely reason?

Accepted Answer

The IKE gateway configuration is missing.. The configuration references an IKE gateway named 'GW1'. If that gateway is not configured or missing, IKE negotiation cannot start.

Answer

The tunnel interface is not in a zone.

Answer

The proxy-id protocol should be set to '0' for all.

Answer

The crypto profile name is invalid.

Question 5

Refer to the exhibit. A firewall log shows these messages for an IPSec tunnel. Which configuration mismatch is the likely cause?

Accepted Answer

IKE Phase 2 proposal mismatch.. The log indicates Phase 2 negotiation failed due to no acceptable proposal set. This points to a mismatch in IPSec parameters (e.g., encryption, authentication, lifetime).

Answer

IKE Phase 1 proposal mismatch.

Answer

Preshared key mismatch.

Answer

Invalid peer IP address.

Question 6

Which TWO conditions are required for a successful GlobalProtect connection using certificate authentication?

Accepted Answer

The client certificate must be issued by a CA trusted by the firewall.. Certificate authentication requires the client certificate to be trusted by the firewall (the CA must be trusted), and the GlobalProtect portal must have an SSL certificate for the web interface.

Answer

The user's browser must have the firewall's root CA certificate.

Answer

The firewall must have the client certificate's public key.

Answer

The client must have a valid username and password.

Question 7

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Accepted Answer

Verify the routing table on both firewalls.. Common causes for no traffic despite tunnel up include mismatched proxy IDs, missing security policies, or routing issues.

Answer

Increase the IPSec SA lifetime.

Answer

Ensure the tunnel interface is placed in a virtual router.

Question 8

Which TWO features are exclusive to GlobalProtect gateway configurations and not available on the portal?

Accepted Answer

Enforcement of host integrity checks.. Host integrity checks and internal gateway configuration for split tunneling are configured only on the gateway, not on the portal.

Answer

Clientless VPN access.

Answer

Application override settings.

Answer

Use of SSL as a transport protocol.

Question 9

A remote user's GlobalProtect client disconnects every 10 minutes. What setting should the administrator check?

Accepted Answer

The ping interval on the gateway.. The gateway sends keepalive pings to maintain the tunnel. If the ping interval is set too short or the threshold for missed pings is low, the client may disconnect prematurely.

Answer

The reconnection interval on the portal.

Answer

The idle timeout on the authentication profile.

Answer

The UDP checksum offloading on the client.

Question 10

A company uses GlobalProtect with internal gateways for accessing data center resources. Users on the internal network should not use the VPN. What is the best practice configuration?

Accepted Answer

Use the Internal Gateway with a pre-logon check.. The GlobalProtect internal gateway feature allows the agent to detect when the user is inside the corporate network and bypass tunnel establishment.

Answer

Use the same portal for both internal and external with a single gateway.

Answer

Set the gateway to require internal client detection via IP range exclusion.

Answer

Disable the GlobalProtect agent for internal IP ranges.

Question 11

During a security audit, it is discovered that the GlobalProtect gateway allows clients to use weak encryption algorithms. Which configuration object controls this?

Accepted Answer

The IPSec crypto profile associated with the gateway.. The IPSec crypto profile attached to the GlobalProtect gateway specifies the allowed encryption and authentication algorithms for the data tunnel.

Answer

The SSL/TLS service profile on the gateway.

Answer

The GlobalProtect portal agent configuration.

Answer

The SSL/SSH service profile on the firewall.

Question 12

A company wants to deploy GlobalProtect to 10,000 remote users. Which method provides the most scalable and automated distribution of the client software?

Accepted Answer

Web-based download from the portal.. Web-based download from the portal is the simplest and most automated method for large-scale deployments, as users can download the client on demand.

Answer

Manual installation via USB.

Answer

Email attachment.

Answer

Group Policy deployment via Active Directory.

Question 13

A network engineer configures an IPSec tunnel with multiple proxy IDs for different subnets. After committing, only one proxy ID establishes IPsec SAs. What should the engineer check?

Accepted Answer

The number of concurrent tunnels allowed.. There is a maximum number of concurrent IPsec SAs (tunnels) per IKE gateway. If the limit is reached, additional proxy IDs will not establish SAs.

Answer

The IPSec crypto profile.

Answer

The IKE gateway mode.

Answer

The tunnel monitor settings.

Question 14

An administrator configures a VPN tunnel between two Palo Alto firewalls. The tunnel shows as active, but traffic is not being encrypted. What configuration step is most likely missing?

Accepted Answer

A security policy allowing traffic from the tunnel interface to the destination.. Even if the tunnel is active, a security policy is required to allow traffic from the source to the destination zone; without it, packets are dropped before encryption.

Answer

The encryption algorithm must be set to null.

Answer

A NAT policy to translate private addresses.

Answer

The tunnel interface must be assigned to a security zone.

Question 15

A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?

Accepted Answer

Configure a certificate profile in the gateway's authentication settings. Option B is correct because the gateway must use a certificate profile to authenticate client certificates. Option A is incorrect because client authentication in the portal is for portal access, not gateway. Option C is incorrect because the IP pool assigns IP addresses but does not enforce certificate authentication. Option D is incorrect because the gateway's tunnel interface IP is unrelated to certificate authentication.

Answer

Define a tunnel interface with an IP address that matches the certificate subject

Answer

Set the gateway's IP pool to require certificate authentication

Answer

Configure client authentication in the portal with a certificate profile