Hard Difficulty Questions

Disable SSL decryption for the proxy traffic.

Why wrong: This would prevent the firewall from seeing the actual threats.

Create a specific 'Proxy' zone and apply an App-ID policy.

Why wrong: This does not help with identifying the end host or content.

Configure the proxy as a 'Trusted' source in the Device > Setup menu.

Why wrong: This does not enable deep packet inspection of the proxied traffic.

Check the client's OS version.

Why wrong: While possible, policy configuration is a more likely cause for a reset.

Check the authentication server status.

Why wrong: The user is already authenticated, so this is not the issue.

Restart the GlobalProtect service.

Why wrong: This is a disruptive step and not the first troubleshooting action.

VLAN ID.

Why wrong: VLANs are not required for site-to-site tunnels.

DHCP server scope.

Why wrong: DHCP is not relevant to site-to-site gateway setup.

Packet Capture (pcap)

Why wrong: Pcap shows the packet content, not necessarily the policy match logic.

GlobalProtect logs

Why wrong: This is for VPN logs only.

Traffic Monitor

Why wrong: Traffic monitor shows history, but the test command is the diagnostic tool.

Disable the security policy.

Why wrong: This would allow traffic but stop logging, the opposite of the goal.

Implement a Decryption Policy.

Why wrong: This is for inspecting encrypted traffic content, not just application monitoring.

Create a mirror port on the switch.

Why wrong: This is a network-layer solution outside the firewall configuration.

Zone Routing

Why wrong: Not a profile.

Policy Optimizer

Why wrong: Management tool.

Increase the GlobalProtect timeout value.

Why wrong: Timeouts address connection stability, not packet loss due to size.

Disable hardware offloading for IPv6.

Why wrong: Disabling offloading is usually for specific bug troubleshooting, not general MTU issues.

Enable IPv6 transition mechanisms on the external interface.

Why wrong: This does not address MTU fragmentation issues.

Move the security policy to the top of the policy list.

Why wrong: Policy order does not bypass the category filtering configured within the profile.

Add the site to the 'Blocked' list in the URL Filtering profile.

Why wrong: This would reinforce the block rather than allow it.

Create a new URL category and add the domain to it, then block that category.

Why wrong: This would not provide access to the user.

Mismatched DH Group in Phase 2.

Why wrong: Phase 2 mismatches usually result in 'QM-Idle' or other errors after Phase 1 succeeds.

Incorrect Proxy-ID settings.

Why wrong: Proxy-ID issues are usually detected during the tunnel establishment attempt.

Expired certificate on the peer.

Why wrong: Certificate issues would prevent the completion of authentication, not the initial packet exchange.

Verify the MAC address table.

Why wrong: MAC address tables do not affect App-ID identification.

Check the system clock synchronization.

Why wrong: While good practice, it does not impact application identification.

BGP peer status.

Why wrong: BGP status does not influence individual traffic policies.

Interface physical status.

Why wrong: Policies aren't based on physical interface status.

It triggers an alert but does not interfere with the traffic flow.

Why wrong: This describes the 'Alert' action.

It blocks the source IP address for a specified duration.

Why wrong: This is the function of the 'Block IP' setting in a DoS profile.

It drops the packet but allows the TCP session to continue.

Why wrong: This describes the 'Drop' action.

Forces the session to terminate.

Why wrong: It just logs the end state.

Immediately notifies the administrator.

Why wrong: That requires SNMP/Email alerts.

Block

Why wrong: Standard action to stop the threat.

Allow

Why wrong: 'Allow' is not an action in a threat profile, as threats are by definition blocked.

Monitor

Why wrong: 'Monitor' is not a valid action in the standard Vulnerability Protection profile.

To force traffic over specific ports.

Why wrong: Port settings are part of the Service object.

To enable SSL decryption for those applications.

Why wrong: SSL decryption is set via profiles.

To increase security by blocking unknown traffic.

Why wrong: App-ID handles blocking; the group is for management.

The source zone is incorrect.

Why wrong: If the zone were incorrect, it wouldn't match the policy.

The firewall is in transparent mode.

Why wrong: Mode does not affect policy evaluation.

The security profile is missing.

Why wrong: Profiles do not cause drops; they inspect traffic.

The traffic is coming from a zone with no security profile assigned.

Why wrong: Security profiles do not affect policy match decisions.

The firewall is in Layer 2 mode and the MAC address table is full.

Why wrong: MAC table limitations result in flooding, not policy drops.

The App-ID is unidentified, causing a drop by the default cleanup rule.

Why wrong: App-ID unidentified traffic is handled by the interzone policy if configured, not intrazone.

The firewall will drop all traffic.

Why wrong: Allowing 'any' is permissive, not restrictive.

Performance overhead.

Why wrong: Performance impact is negligible compared to security risk.

The firewall cannot log the traffic.

Why wrong: It still logs the traffic.

Source IP address.

Why wrong: This is for routing, not path selection quality.

Static cost metrics.

Why wrong: Static costs don't account for dynamic link quality.

Interface priority only.

Why wrong: Priority is one factor, but performance metrics are primary.

Mobile User Connection

Why wrong: This is for GlobalProtect end-user devices.

Prisma Access Insights

Why wrong: This is a monitoring tool, not a connection type.

Remote Network Connection

Why wrong: This is for connecting branch offices to the cloud.