PCNSE Secure Access and VPN Practice Test 4 — 15 Questions

Question 1

A network engineer is deploying GlobalProtect with pre-logon access. The goal is to allow domain-joined machines to connect to the VPN before any user logs in, so that login scripts and Group Policy updates can run. Which two configurations are required to support pre-logon? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a security policy that allows traffic from the pre-logon zone to the necessary internal resources.. To enable pre-logon, you must enable the pre-logon setting in the portal configuration and create a security policy that allows traffic from the pre-logon user to required resources. These two steps ensure the tunnel can be established before login and that necessary traffic is permitted.

Answer

Configure the portal to use LDAP authentication for pre-logon users.

Answer

Set the GlobalProtect agent to 'User-Logon' mode instead of 'Pre-Logon' mode.

Answer

Configure a client certificate for machine authentication in the portal's certificate profile.

Question 2

A network administrator is troubleshooting a site-to-site IPsec VPN between two Palo Alto Networks firewalls. The VPN tunnel is up, but traffic is not passing. The administrator checks the routing table and sees a route to the remote subnet via the tunnel interface. What should the administrator check next to resolve the issue?

Accepted Answer

Check the security policies to ensure traffic is allowed between the tunnel zone and the internal zone.. After confirming the tunnel is up and routing is correct, the next step is to verify security policies. Traffic must be explicitly allowed between the tunnel zone and internal zones. Missing or misconfigured policies are a frequent cause of traffic not passing despite a successful tunnel.

Answer

Verify that the proxy IDs are correctly configured on both peers.

Answer

Ensure that the tunnel interface is assigned to the correct zone and that the zone is included in the security policy.

Answer

Confirm that the IKE gateway is using the correct pre-shared key.

Question 3

A company is deploying GlobalProtect for remote users. The security team wants to ensure that only users who authenticate with multi-factor authentication (MFA) can access the VPN. The company uses RADIUS for authentication. Which configuration should the administrator implement to enforce MFA for GlobalProtect?

Accepted Answer

Configure the GlobalProtect portal to use a RADIUS authentication profile that includes MFA.. To enforce MFA with RADIUS, the administrator must configure the GlobalProtect portal's authentication profile to use a RADIUS server that performs MFA. This ensures that users must satisfy MFA challenges during authentication. Other options do not directly enforce MFA at the authentication stage.

Answer

Configure a security policy that requires MFA for all traffic from the GlobalProtect zone.

Answer

Enable MFA in the GlobalProtect agent configuration on the portal.

Answer

Set up a client certificate requirement in the portal's certificate profile to act as a second factor.

Question 4

An administrator is configuring GlobalProtect with certificate authentication. The portal and gateway are using certificates signed by an internal enterprise CA. Users report that they cannot connect; the GlobalProtect client shows 'Certificate validation failed'. The administrator has verified that the client certificates are issued by the correct CA and are not expired. Which two additional configurations are required on the firewall to resolve this? (Choose two.)

Accepted Answer

Add the root and intermediate CA certificates to the firewall's certificate store.. For GlobalProtect certificate authentication, the firewall must trust the CA that issued the client certificates. This is achieved by adding the root and intermediate CA certificates to the firewall's certificate store and then referencing them in a certificate profile that is applied to the portal and gateway. The certificate profile specifies the trusted CAs for client certificate validation. Without these two configurations, the firewall cannot validate the client certificate, causing the 'Certificate validation failed' error.

Answer

In the portal and gateway authentication profiles, enable 'Retrieve user group' from the certificate.

Answer

Configure the portal and gateway to use an SSL/TLS service profile that includes the CA certificates.

Answer

Ensure that the client certificate's subject or SAN includes the User Principal Name (UPN) that matches the user's login.

Question 5

A company has deployed GlobalProtect with multiple internal gateways for redundancy. A remote user connects to the portal and receives a list of gateways. The user's client is configured to connect to the gateway with the lowest priority value. However, the user is consistently connecting to a gateway that is geographically distant, resulting in high latency. The administrator wants to ensure that the user connects to the closest gateway based on network latency. Which GlobalProtect configuration should the administrator implement?

Accepted Answer

On the portal, set the gateway selection to 'Best Available Gateway' and ensure that the gateways are configured with the same priority.. To ensure the GlobalProtect client connects to the gateway with the lowest latency, the portal should be configured with the 'Best Available Gateway' selection method. This method measures the response time to each gateway and selects the best one. The priority values are used only if response times are equal or if the best available method fails. Therefore, setting the same priority for all gateways ensures latency is the deciding factor.

Answer

On the portal, configure the gateway selection to 'Best Available Gateway' and enable 'Measure Response Time' for each gateway.

Answer

Enable 'Source Interface Selection' on the portal to use the incoming interface for gateway selection.

Answer

Configure the gateways with different priority values and enable 'Response Time' in the gateway selection criteria.

Question 6

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.

Question 7

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 8

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

Accepted Answer

Configure filter, Start capture, Generate traffic, Stop capture, Download. The correct sequence for packet capture on a Palo Alto Networks firewall is: first configure the capture filter to define which traffic to capture, then start the capture, generate the traffic, stop the capture to finalize the data, and finally download the capture file. This order ensures that the desired traffic is captured cleanly and the file is ready for analysis.

Answer

Start capture, Configure filter, Generate traffic, Stop capture, Download

Answer

Configure filter, Generate traffic, Start capture, Stop capture, Download

Answer

Configure filter, Start capture, Generate traffic, Download, Stop capture

Question 9

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

Accepted Answer

Incorrect gateway IP address in portal configuration. When the portal and gateway are on the same firewall, the portal configuration must specify the correct IP address or FQDN for the gateway. If the gateway IP address in the portal configuration is incorrect, the client will successfully authenticate to the portal but then fail to establish a tunnel to the gateway because it cannot reach the gateway at the specified address. This is the most common cause of this symptom.

Answer

User not assigned a license

Answer

Gateway interface not in the same zone as portal

Answer

Gateway MTU mismatch

Question 10

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

Accepted Answer

debug ike global on. 'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Answer

show counter global | match ipsec

Answer

show log system

Answer

debug flow basic

Question 11

When configuring GlobalProtect with certificate authentication, a user reports that the client prompts for username and password even though the certificate is installed. What is the most likely cause?

Accepted Answer

The portal authentication profile requires both certificate and password. When a GlobalProtect portal authentication profile is configured to require both certificate and password, the client will prompt for username and password even if a valid certificate is present. This is because the authentication profile explicitly enforces multi-factor authentication, meaning the certificate alone is insufficient for portal authentication. The client must satisfy all configured authentication factors before proceeding.

Answer

The certificate is expired

Answer

The client certificate does not match the username

Answer

The root CA certificate is not imported into the firewall

Question 12

Which TWO of the following are supported authentication methods for IPSec VPN tunnel setup between two Palo Alto Networks firewalls?

Accepted Answer

Certificate. Option A (Certificate) is correct because Palo Alto Networks firewalls support certificate-based authentication for IPSec VPN IKE peers, where each firewall presents an X.509 certificate and validates the peer's certificate against a trusted CA profile during IKE Phase 1. Option E (Pre-shared key) is correct because PSK authentication is a native, commonly used IKE Phase 1 authentication method for site-to-site IPSec tunnels between Palo Alto firewalls, configured under the IKE Gateway's authentication settings. Options B (RADIUS), C (SAML), and D (LDAP) are not valid IKE peer authentication methods for IPSec tunnel establishment; these are user authentication mechanisms used for GlobalProtect, administrative access, or User-ID, and they operate at the application/user layer rather than authenticating the IKE gateway peer itself.

Answer

RADIUS

Answer

SAML

Answer

LDAP

Question 13

Which THREE of the following are capabilities of GlobalProtect Host Information Profile (HIP)?

Accepted Answer

Check if antivirus is installed and running. Option C is correct because HIP collects host data on endpoint security software, including whether antivirus/anti-malware is installed, running, and up to date, which is a core HIP check. Option D is correct because HIP can verify disk encryption status (for example, BitLocker or FileVault) as part of its endpoint compliance data. Option E is correct because HIP reports the operating system version and patch level, allowing security policies to require a minimum OS version. Option A is not a HIP capability because HIP profiles endpoint host attributes, not the user's geographic location, which is handled by other means such as source region or GlobalProtect gateway selection. Option B is not a HIP capability because HIP does not natively report browser version; browser checks are not part of the standard HIP object categories.

Answer

Check the user's location

Answer

Check the browser version

Question 14

An organization has two sites connected via IPSec VPN. The tunnel is up, but ICMP traffic between sites fails. No other traffic works. The firewall policy allows any-any. What is the most likely issue?

Accepted Answer

The proxy IDs (interesting traffic) are not configured correctly.. When the IPSec tunnel is up but no traffic passes, the most common cause is misconfigured proxy IDs (also called interesting traffic selectors). Proxy IDs define which source/destination subnets are permitted through the tunnel; if they don't match on both peers, the tunnel may establish (IKE and IPsec SAs are created) but the firewall will not encrypt or forward traffic because it does not match the defined selectors. Since the firewall policy allows any-any, the issue is not a policy block, pointing directly to proxy ID mismatch.

Answer

The IKE phase 1 proposal is mismatched.

Answer

The IPSec crypto profile uses AES-256 and the peer uses 3DES.

Answer

The tunnel interface MTU is set too low.

Question 15

Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?

Accepted Answer

A configuration error causes duplicate SAs.. In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway. Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.

Answer

Multiple Phase 2 tunnels are established.

Answer

Multiple Phase 1 proposals are accepted.

Answer

The firewall is under DDoS attack.