PCNSE Secure Access and VPN — Timed 10 Questions

Question 1

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

Accepted Answer

The remote users' computers are not domain-joined.. Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Answer

The external gateway is not configured for Kerberos authentication.

Answer

The authentication profile is not configured on the gateway.

Answer

The GlobalProtect gateway certificate is not trusted by the client.

Question 2

A company is deploying GlobalProtect with internal gateways. They want to ensure that users who are inside the corporate network connect directly to internal resources without going through the firewall. Which configuration is required?

Accepted Answer

Set the portal's 'Internal Host Detection' to detect the internal network and set 'Gateway' to 'None' for the internal network.. Option D is correct because GlobalProtect's Internal Host Detection (IHD) feature allows the portal to detect whether a user is inside the corporate network. When the portal detects the user is internal, it can be configured to assign 'None' as the gateway, meaning the client will not establish a VPN tunnel and will connect directly to internal resources. This ensures traffic does not hairpin through the firewall.

Answer

Configure the portal to assign the gateway only when the user is external.

Answer

Set the gateway's 'Tunnel Mode' to 'No' for internal users.

Answer

Configure the gateway agent with internal host detection.

Question 3

A firewall is configured with a GlobalProtect gateway that uses an IPSec tunnel. Remote users can connect but cannot access any resources. The administrator verifies that the tunnel is established and the client receives an IP address. What is the most likely cause?

Accepted Answer

The firewall does not have a route to the virtual IP pool.. When a GlobalProtect gateway uses an IPSec tunnel, the client receives an IP address from a virtual IP pool assigned to the tunnel interface. If the firewall lacks a route to that virtual IP pool, return traffic from internal resources cannot reach the client, even though the tunnel is established and the client has an IP. This is a common misconfiguration because the tunnel interface itself does not automatically inject a route for the pool into the virtual router.

Answer

The tunnel interface is not in a virtual router.

Answer

The security policy does not allow traffic from the VPN zone.

Answer

The IP pool for the VPN client is exhausted.

Question 4

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

Accepted Answer

The local and peer IP addresses are swapped on one side.. Option C is correct because if the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Answer

The tunnel interface is not assigned to a security zone.

Answer

Dead peer detection (DPD) is not configured.

Answer

The MTU on the WAN interface is set too low.

Question 5

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 6

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

Accepted Answer

Configure a security policy with user-ID matching the required users.. Option D is correct because the security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Answer

Use user-ID on the GlobalProtect gateway.

Answer

Configure group mapping on the GlobalProtect portal.

Answer

Create a HIP profile and assign it to the gateway.

Question 7

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. Option C is correct because GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.

Question 8

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Accepted Answer

Tunnel interface. A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Answer

Client certificate

Answer

Security zone for the tunnel interface

Answer

GlobalProtect portal configuration

Question 9

Which THREE are valid methods for configuring a site-to-site VPN on a Palo Alto Networks firewall?

Accepted Answer

Policy-based VPN using a tunnel monitor. Option A is correct because a policy-based VPN on Palo Alto Networks uses a tunnel monitor to verify the health of the IPSec tunnel by sending ICMP probes to the peer's tunnel IP address. This allows the firewall to detect tunnel failures and trigger failover or route changes, which is a standard method for site-to-site VPN configuration.

Answer

GlobalProtect Gateway configuration

Answer

SSL VPN using GlobalProtect portal

Question 10

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.