PCNSE Secure Access and VPN Practice Question
A company wants to use GlobalProtect with pre-logon (user unknown). After configuration, users report that they can authenticate but cannot access the gateway during pre-logon. Which configuration item is most likely missing?
⚠ Common exam trap
A common mix-up: candidates confuse the pre-logon token (a gateway setting for token-based pre-logon) with certificate trust issues, assuming the token must be enabled on the portal, when in fact the certificate trust failure is the root cause of the gateway access problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Gateway's certificate not imported or untrusted
During pre-logon, the GlobalProtect gateway must present a trusted certificate to the client before any user authentication occurs, because the user is unknown and the client cannot rely on user credentials to validate the gateway. If the gateway's certificate is not imported or is untrusted, the client will reject the SSL/TLS handshake, preventing access even though portal authentication succeeds. This is the most common cause of pre-logon connectivity failure after portal authentication works.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pre-logon token not enabled on the portal
Why it's wrong here
Portal pre-logon token enables the client to store credentials; without it, pre-logon may fail at portal authentication.
- ✓
Gateway's certificate not imported or untrusted
Why this is correct
If the gateway's certificate is not trusted, the client will reject the connection during pre-logon.
- ✗
Pre-logon token not enabled on the gateway
Why it's wrong here
Gateway pre-logon token is also needed to allow access before user login.
- ✗
Portal's authentication profile does not allow pre-logon
Why it's wrong here
Portal authentication profile can restrict pre-logon, but users are authenticating successfully to the portal.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.