PCNSE Secure Access and VPN Practice Test 3 — 15 Questions

Question 1

A network administrator configures GlobalProtect for remote users. Users report they can connect but cannot access internal resources. The firewall shows the user is connected with a valid IP. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Split tunneling is misconfigured, causing missing internal routes.. When GlobalProtect users can connect and obtain a valid IP but cannot access internal resources, the most common cause is misconfigured split tunneling. If split tunneling is not properly set to route internal traffic through the VPN tunnel, the client may not have the necessary routes for internal subnets, causing traffic to be sent directly to the internet instead of through the firewall. This results in connectivity to the gateway but failure to reach internal resources.

Answer

The client's local firewall is blocking traffic.

Answer

The GlobalProtect gateway is not configured with the correct internal DNS suffix.

Answer

The authentication profile is set to require multi-factor authentication.

Question 2

An organization has two sites connected via IPSec VPN. The tunnel is up, but ICMP traffic between sites fails. No other traffic works. The firewall policy allows any-any. What is the most likely issue?

Accepted Answer

The proxy IDs (interesting traffic) are not configured correctly.. When the IPSec tunnel is up but no traffic passes, the most common cause is misconfigured proxy IDs (also called interesting traffic selectors). Proxy IDs define which source/destination subnets are permitted through the tunnel; if they don't match on both peers, the tunnel may establish (IKE and IPsec SAs are created) but the firewall will not encrypt or forward traffic because it does not match the defined selectors. Since the firewall policy allows any-any, the issue is not a policy block, pointing directly to proxy ID mismatch.

Answer

The IKE phase 1 proposal is mismatched.

Answer

The IPSec crypto profile uses AES-256 and the peer uses 3DES.

Answer

The tunnel interface MTU is set too low.

Question 3

A company integrates GlobalProtect with SAML for SSO. Users report that after authentication, they receive a 'Portal cannot be reached' error. The firewall logs show the SAML authentication succeeded. What should the administrator check?

Accepted Answer

The SSL/TLS service profile on the portal is not bound to the correct certificate.. The 'Portal cannot be reached' error after successful SAML authentication indicates the browser cannot establish a trusted SSL/TLS connection to the portal. The SAML authentication succeeded, so the issue is not with the SAML profile or certificate. The SSL/TLS service profile on the portal must be bound to a certificate that matches the portal's FQDN and is trusted by the client browser; otherwise, the browser will block the connection, causing this error.

Answer

The user's browser is blocking pop-ups from the portal.

Answer

The GlobalProtect portal agent is not set to use the correct SAML profile.

Answer

The SAML identity provider's certificate is not imported on the firewall.

Question 4

Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?

Accepted Answer

A configuration error causes duplicate SAs.. In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway. Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.

Answer

Multiple Phase 2 tunnels are established.

Answer

Multiple Phase 1 proposals are accepted.

Answer

The firewall is under DDoS attack.

Question 5

Refer to the exhibit. A firewall administrator configures an IPSec tunnel. After committing, the tunnel never becomes active. What is the most likely reason?

Accepted Answer

The IKE gateway configuration is missing.. B is correct because an IPSec tunnel requires both an IKE gateway configuration and an IPSec crypto profile to establish Phase 1 and Phase 2 security associations. Without the IKE gateway, the firewall has no peer address, authentication method, or pre-shared key to initiate IKEv1/v2 exchanges, so the tunnel remains down. The exhibit likely shows a tunnel interface and crypto profile but omits the IKE gateway object, which is mandatory for tunnel activation.

Answer

The tunnel interface is not in a zone.

Answer

The proxy-id protocol should be set to '0' for all.

Answer

The crypto profile name is invalid.

Question 6

Which TWO conditions are required for a successful GlobalProtect connection using certificate authentication?

Accepted Answer

The client certificate must be issued by a CA trusted by the firewall.. Certificate authentication requires the firewall to validate the client certificate against a trusted Certificate Authority (CA). The firewall maintains a list of trusted CA certificates; if the client certificate is not signed by one of these CAs, the authentication fails. This ensures the client certificate is genuine and issued by an authority the firewall trusts.

Answer

The user's browser must have the firewall's root CA certificate.

Answer

The firewall must have the client certificate's public key.

Answer

The client must have a valid username and password.

Question 7

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Accepted Answer

Verify the routing table on both firewalls.. Even if the VPN tunnel is up (Phase 1 and Phase 2 SAs established), traffic may still fail if the firewall does not have a route to the destination network via the tunnel interface. Without a correct route in the routing table, the firewall will drop the packet or send it out the wrong interface. Verifying the routing table ensures that the tunnel interface is the next hop for the remote subnet.

Answer

Increase the IPSec SA lifetime.

Answer

Ensure the tunnel interface is placed in a virtual router.

Question 8

Which TWO features are exclusive to GlobalProtect gateway configurations and not available on the portal?

Accepted Answer

Enforcement of host integrity checks.. Host integrity checks (HIP) are enforced by the GlobalProtect gateway, not the portal. The gateway performs the actual assessment of the endpoint's security posture (e.g., antivirus status, patch level) during tunnel establishment, while the portal only distributes HIP profiles and collects reports. This makes option B correct.

Answer

Clientless VPN access.

Answer

Application override settings.

Answer

Use of SSL as a transport protocol.

Question 9

A remote user's GlobalProtect client disconnects every 10 minutes. What setting should the administrator check?

Accepted Answer

The ping interval on the gateway.. The GlobalProtect client uses a keepalive mechanism to maintain the VPN tunnel. The ping interval on the gateway determines how often the client sends ICMP echo requests to the gateway to verify connectivity. If the ping interval is set too high or the client fails to receive responses within the configured timeout, the client may interpret the connection as lost and disconnect. A 10-minute disconnection pattern strongly suggests the ping interval or related timeout is misconfigured, causing the client to drop the tunnel after a period of inactivity.

Answer

The reconnection interval on the portal.

Answer

The idle timeout on the authentication profile.

Answer

The UDP checksum offloading on the client.

Question 10

A company uses GlobalProtect with internal gateways for accessing data center resources. Users on the internal network should not use the VPN. What is the best practice configuration?

Accepted Answer

Use the Internal Gateway with a pre-logon check.. Using an Internal Gateway with a pre-logon check allows the GlobalProtect agent to detect that the user is on the internal network and skip the VPN tunnel, while still enforcing security policies. This configuration ensures that internal users do not route traffic through the VPN, avoiding unnecessary overhead and potential routing issues, while the pre-logon check verifies the user's identity before granting access to data center resources.

Answer

Use the same portal for both internal and external with a single gateway.

Answer

Set the gateway to require internal client detection via IP range exclusion.

Answer

Disable the GlobalProtect agent for internal IP ranges.

Question 11

During a security audit, it is discovered that the GlobalProtect gateway allows clients to use weak encryption algorithms. Which configuration object controls this?

Accepted Answer

The IPSec crypto profile associated with the gateway.. The GlobalProtect gateway uses IPSec to secure VPN tunnels between clients and the gateway. The IPSec crypto profile defines the encryption algorithms, authentication methods, and key exchange parameters for these tunnels. If weak encryption algorithms are allowed, it is because the IPSec crypto profile associated with the gateway is configured with those weak options.

Answer

The SSL/TLS service profile on the gateway.

Answer

The GlobalProtect portal agent configuration.

Answer

The SSL/SSH service profile on the firewall.

Question 12

A company wants to deploy GlobalProtect to 10,000 remote users. Which method provides the most scalable and automated distribution of the client software?

Accepted Answer

Web-based download from the portal.. Web-based download from the portal is the most scalable and automated method because GlobalProtect portals can host the client installer and automatically push it to users when they authenticate. This eliminates manual intervention, supports thousands of concurrent downloads, and integrates with the portal's auto-update mechanism to ensure all remote users run the latest version without IT overhead.

Answer

Manual installation via USB.

Answer

Email attachment.

Answer

Group Policy deployment via Active Directory.

Question 13

A network engineer configures an IPSec tunnel with multiple proxy IDs for different subnets. After committing, only one proxy ID establishes IPsec SAs. What should the engineer check?

Accepted Answer

The number of concurrent tunnels allowed.. Palo Alto Networks firewalls have a default limit on the number of concurrent IPsec tunnels. When multiple proxy IDs are configured, each proxy ID requires its own IPsec security association (SA). If the tunnel limit is reached, only the first proxy ID establishes SAs, and subsequent ones fail. Checking and increasing the 'Number of Tunnels' setting under the tunnel interface or global IPSec configuration resolves this.

Answer

The IPSec crypto profile.

Answer

The IKE gateway mode.

Answer

The tunnel monitor settings.

Question 14

An administrator configures a VPN tunnel between two Palo Alto firewalls. The tunnel shows as active, but traffic is not being encrypted. What configuration step is most likely missing?

Accepted Answer

A security policy allowing traffic from the tunnel interface to the destination.. Even when a VPN tunnel is active (Phase 1 and Phase 2 SAs are established), traffic will not be encrypted unless a security policy explicitly permits traffic from the tunnel interface to the destination zone. On Palo Alto firewalls, inter-zone traffic requires a security policy to allow the session; without it, the firewall drops the traffic before it can be encrypted and sent over the tunnel. The tunnel being up only indicates IKE/IPsec negotiation succeeded, not that data-plane forwarding is authorized.

Answer

The encryption algorithm must be set to null.

Answer

A NAT policy to translate private addresses.

Answer

The tunnel interface must be assigned to a security zone.

Question 15

A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?

Accepted Answer

Configure a certificate profile in the gateway's authentication settings. A certificate profile must be configured in the gateway's authentication settings to enforce certificate-based authentication. This profile defines the trusted Certificate Authority (CA) and validation criteria (e.g., CRL checking, OCSP), ensuring only clients presenting a valid certificate issued by that CA can establish a GlobalProtect tunnel. Without this, the gateway would fall back to username/password or other configured authentication methods.

Answer

Define a tunnel interface with an IP address that matches the certificate subject

Answer

Set the gateway's IP pool to require certificate authentication

Answer

Configure client authentication in the portal with a certificate profile