PCNSE Secure Access and VPN — Timed 15 Questions

Question 1

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

Accepted Answer

The remote users' computers are not domain-joined.. Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Answer

The external gateway is not configured for Kerberos authentication.

Answer

The authentication profile is not configured on the gateway.

Answer

The GlobalProtect gateway certificate is not trusted by the client.

Question 2

A company is deploying GlobalProtect with internal gateways. They want to ensure that users who are inside the corporate network connect directly to internal resources without going through the firewall. Which configuration is required?

Accepted Answer

Set the portal's 'Internal Host Detection' to detect the internal network and set 'Gateway' to 'None' for the internal network.. Option D is correct because GlobalProtect's Internal Host Detection (IHD) feature allows the portal to detect whether a user is inside the corporate network. When the portal detects the user is internal, it can be configured to assign 'None' as the gateway, meaning the client will not establish a VPN tunnel and will connect directly to internal resources. This ensures traffic does not hairpin through the firewall.

Answer

Configure the portal to assign the gateway only when the user is external.

Answer

Set the gateway's 'Tunnel Mode' to 'No' for internal users.

Answer

Configure the gateway agent with internal host detection.

Question 3

A firewall is configured with a GlobalProtect gateway that uses an IPSec tunnel. Remote users can connect but cannot access any resources. The administrator verifies that the tunnel is established and the client receives an IP address. What is the most likely cause?

Accepted Answer

The firewall does not have a route to the virtual IP pool.. When a GlobalProtect gateway uses an IPSec tunnel, the client receives an IP address from a virtual IP pool assigned to the tunnel interface. If the firewall lacks a route to that virtual IP pool, return traffic from internal resources cannot reach the client, even though the tunnel is established and the client has an IP. This is a common misconfiguration because the tunnel interface itself does not automatically inject a route for the pool into the virtual router.

Answer

The tunnel interface is not in a virtual router.

Answer

The security policy does not allow traffic from the VPN zone.

Answer

The IP pool for the VPN client is exhausted.

Question 4

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

Accepted Answer

The local and peer IP addresses are swapped on one side.. Option C is correct because if the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Answer

The tunnel interface is not assigned to a security zone.

Answer

Dead peer detection (DPD) is not configured.

Answer

The MTU on the WAN interface is set too low.

Question 5

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

Accepted Answer

The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.. The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Answer

The GlobalProtect app's cookie integrity is corrupted.

Answer

The GlobalProtect client needs to be reinstalled.

Answer

The user-id agent is not resolving usernames correctly.

Question 6

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

Accepted Answer

Configure a security policy with user-ID matching the required users.. Option D is correct because the security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Answer

Use user-ID on the GlobalProtect gateway.

Answer

Configure group mapping on the GlobalProtect portal.

Answer

Create a HIP profile and assign it to the gateway.

Question 7

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

Accepted Answer

The gateway selection rules on the portal do not match the users' source IP ranges.. Option C is correct because GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Answer

Users are manually selecting the wrong gateway from the client.

Answer

The gateways are not configured with priority settings.

Answer

The DNS resolution for the portal returns multiple IPs in round-robin.

Question 8

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Accepted Answer

Tunnel interface. A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Answer

Client certificate

Answer

Security zone for the tunnel interface

Answer

GlobalProtect portal configuration

Question 9

Which THREE are valid methods for configuring a site-to-site VPN on a Palo Alto Networks firewall?

Accepted Answer

Policy-based VPN using a tunnel monitor. Option A is correct because a policy-based VPN on Palo Alto Networks uses a tunnel monitor to verify the health of the IPSec tunnel by sending ICMP probes to the peer's tunnel IP address. This allows the firewall to detect tunnel failures and trigger failover or route changes, which is a standard method for site-to-site VPN configuration.

Answer

GlobalProtect Gateway configuration

Answer

SSL VPN using GlobalProtect portal

Question 10

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

Accepted Answer

No security policy allows traffic from the VPN zone.. When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Answer

The IKE gateway is not configured with the correct peer IP.

Answer

The proxy IDs do not match the remote peer.

Answer

The tunnel interface is not assigned to a zone.

Question 11

Refer to the exhibit. A user inside the corporate network (IP: 10.1.1.5) connects to the portal. The portal detects the internal host and does not assign a gateway. However, the user still cannot access internal resources. What is the most likely issue?

Accepted Answer

The GlobalProtect client is configured to always use the gateway.. When the GlobalProtect client is configured to 'always use the gateway,' it forces all traffic (including internal traffic) to be tunneled to the gateway even when the user is already inside the corporate network. The portal correctly detects the internal host and does not assign a gateway, but the client still attempts to send traffic through the gateway, which is not reachable or not configured to forward internal traffic back, breaking access to internal resources.

Answer

The gateway is not configured with a client IP pool.

Answer

The portal's authentication profile is incorrect.

Answer

The portal is not configured with internal host detection.

Question 12

A large enterprise uses a Palo Alto Networks firewall as the central hub for site-to-site VPN connections to 50 branch offices. Each branch office has a different subnet (e.g., 10.x.0.0/16 where x is the branch number). The VPN tunnels are configured using IKEv2 with pre-shared keys. Recently, the IT team decided to migrate to certificate-based authentication for improved security. They issued certificates from an internal CA to all branch firewalls and the hub firewall. After the migration, all tunnels failed to establish. The hub firewall logs show 'IKE negotiation failed' with error 'no proposal chosen'. The administrator checks the IKE gateway configuration on the hub: the IKE version is IKEv2, the authentication method is set to 'Certificate', and the certificate profile is configured with the root CA certificate. The administrator also verifies that the branch firewalls have the correct certificates and the hub's certificate is trusted. The branch firewalls' IKE gateways are configured with the hub's IP and pre-shared key (still configured as a fallback). What should the administrator do to resolve the issue?

Accepted Answer

Remove the pre-shared key from the IKE gateway configuration on the branch firewalls.. When using certificate-based authentication in IKEv2, the IKE gateway configuration must use only the certificate for authentication. If a pre-shared key is also configured, the firewall will attempt to use PSK authentication instead of the certificate, causing a mismatch with the peer expecting certificate-based authentication. This results in the 'no proposal chosen' error because the authentication method proposed (PSK) does not match the expected method (certificate). Removing the pre-shared key from the branch firewalls' IKE gateway configuration forces them to use the certificate, aligning with the hub's configuration.

Answer

Change the IKE version on the hub to IKEv1.

Answer

Reissue the hub firewall's certificate with the correct subject name.

Answer

Ensure the internal CA is reachable from the branch firewalls.

Question 13

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

Question 14

Match each security rule action to its effect.

Question 15

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

Accepted Answer

Incorrect gateway IP address in portal configuration. When a user can authenticate to the portal but cannot connect to the gateway, the portal may be supplying the wrong gateway IP address. The client uses this IP to initiate the gateway connection. If it is incorrect, the connection fails.

Answer

User not assigned a license

Answer

Gateway interface not in the same zone as portal

Answer

Gateway MTU mismatch