PCNSE Secure Access and VPN — Timed 10 Questions

Question 1

An administrator sees the IPSec tunnel state 'down' under the tunnel monitor. What is the most common cause for this issue?

Accepted Answer

Incorrect pre-shared key. The most common cause for an IPsec tunnel showing 'down' in the tunnel monitor is an incorrect pre-shared key. During IKE Phase 1 authentication, both peers must present matching pre-shared keys; if they differ, the IKE SA negotiation fails, preventing the tunnel from coming up. This is a frequent misconfiguration because the key is manually entered and often mistyped or mismatched between endpoints.

Answer

Proxy ID mismatch

Answer

Tunnel interface IP misconfiguration

Answer

IKE version mismatch

Question 2

Refer to the exhibit. A firewall log shows these messages for an IPSec tunnel. Which configuration mismatch is the likely cause?

Accepted Answer

IKE Phase 2 proposal mismatch.. The log messages indicate that IKE Phase 1 completed successfully (as shown by the 'IKE Phase 1 established' message), but Phase 2 negotiation failed. This points directly to a mismatch in the IKE Phase 2 proposal parameters, such as the IPsec security protocol (ESP vs AH), encryption algorithm, authentication algorithm, or Diffie-Hellman group used for PFS. A Phase 2 proposal mismatch prevents the creation of the IPsec SA, even though the IKE SA is already established.

Answer

IKE Phase 1 proposal mismatch.

Answer

Preshared key mismatch.

Answer

Invalid peer IP address.

Question 3

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

Accepted Answer

The remote users' computers are not domain-joined.. Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Answer

The external gateway is not configured for Kerberos authentication.

Answer

The authentication profile is not configured on the gateway.

Answer

The GlobalProtect gateway certificate is not trusted by the client.

Question 4

A company is deploying GlobalProtect with internal gateways. They want to ensure that users who are inside the corporate network connect directly to internal resources without going through the firewall. Which configuration is required?

Accepted Answer

Set the portal's 'Internal Host Detection' to detect the internal network and set 'Gateway' to 'None' for the internal network.. GlobalProtect's Internal Host Detection (IHD) feature allows the portal to detect whether a user is inside the corporate network. When the portal detects the user is internal, it can be configured to assign 'None' as the gateway, meaning the client will not establish a VPN tunnel and will connect directly to internal resources. This ensures traffic does not hairpin through the firewall.

Answer

Configure the portal to assign the gateway only when the user is external.

Answer

Set the gateway's 'Tunnel Mode' to 'No' for internal users.

Answer

Configure the gateway agent with internal host detection.

Question 5

A firewall is configured with a GlobalProtect gateway that uses an IPSec tunnel. Remote users can connect but cannot access any resources. The administrator verifies that the tunnel is established and the client receives an IP address. What is the most likely cause?

Accepted Answer

The firewall does not have a route to the virtual IP pool.. When a GlobalProtect gateway uses an IPSec tunnel, the client receives an IP address from a virtual IP pool assigned to the tunnel interface. If the firewall lacks a route to that virtual IP pool, return traffic from internal resources cannot reach the client, even though the tunnel is established and the client has an IP. This is a common misconfiguration because the tunnel interface itself does not automatically inject a route for the pool into the virtual router.

Answer

The tunnel interface is not in a virtual router.

Answer

The security policy does not allow traffic from the VPN zone.

Answer

The IP pool for the VPN client is exhausted.

Question 6

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

Accepted Answer

The local and peer IP addresses are swapped on one side.. If the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Answer

The tunnel interface is not assigned to a security zone.

Answer

Dead peer detection (DPD) is not configured.

Answer

The MTU on the WAN interface is set too low.

Question 7

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 8

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

Accepted Answer

Configure a security policy with user-ID matching the required users.. The security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Answer

Use user-ID on the GlobalProtect gateway.

Answer

Configure group mapping on the GlobalProtect portal.

Answer

Create a HIP profile and assign it to the gateway.

Question 9

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.

Question 10

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Accepted Answer

Tunnel interface. A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Answer

Client certificate

Answer

Security zone for the tunnel interface

Answer

GlobalProtect portal configuration