PCNSE Secure Access and VPN Practice Question
A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?
⚠ Common exam trap
Test-takers frequently confuse portal authentication settings with gateway authentication settings, assuming that configuring a certificate profile on the portal will automatically enforce certificate-based access on the gateway, but the gateway requires its own separate authentication configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a certificate profile in the gateway's authentication settings
A certificate profile must be configured in the gateway's authentication settings to enforce certificate-based authentication. This profile defines the trusted Certificate Authority (CA) and validation criteria (e.g., CRL checking, OCSP), ensuring only clients presenting a valid certificate issued by that CA can establish a GlobalProtect tunnel. Without this, the gateway would fall back to username/password or other configured authentication methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define a tunnel interface with an IP address that matches the certificate subject
Why it's wrong here
Tunnel interface IP is unrelated to certificate validation.
- ✗
Set the gateway's IP pool to require certificate authentication
Why it's wrong here
IP pool assignment does not enforce certificate authentication.
- ✓
Configure a certificate profile in the gateway's authentication settings
Why this is correct
The gateway uses a certificate profile to validate client certificates during tunnel establishment.
- ✗
Configure client authentication in the portal with a certificate profile
Why it's wrong here
Client authentication in the portal is for portal access, not gateway tunnel authentication.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.