PCNSE Secure Access and VPN Practice Question
A large enterprise uses a Palo Alto Networks firewall as the central hub for site-to-site VPN connections to 50 branch offices. Each branch office has a different subnet (e.g., 10.x.0.0/16 where x is the branch number). The VPN tunnels are configured using IKEv2 with pre-shared keys. Recently, the IT team decided to migrate to certificate-based authentication for improved security. They issued certificates from an internal CA to all branch firewalls and the hub firewall. After the migration, all tunnels failed to establish. The hub firewall logs show 'IKE negotiation failed' with error 'no proposal chosen'. The administrator checks the IKE gateway configuration on the hub: the IKE version is IKEv2, the authentication method is set to 'Certificate', and the certificate profile is configured with the root CA certificate. The administrator also verifies that the branch firewalls have the correct certificates and the hub's certificate is trusted. The branch firewalls' IKE gateways are configured with the hub's IP and pre-shared key (still configured as a fallback). What should the administrator do to resolve the issue?
⚠ Common exam trap
Test-takers frequently assume a pre-shared key can remain as a fallback without affecting the authentication method negotiation, but in Palo Alto Networks IKEv2, the presence of a PSK overrides certificate authentication, causing a proposal mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the pre-shared key from the IKE gateway configuration on the branch firewalls.
When using certificate-based authentication in IKEv2, the IKE gateway configuration must use only the certificate for authentication. If a pre-shared key is also configured, the firewall will attempt to use PSK authentication instead of the certificate, causing a mismatch with the peer expecting certificate-based authentication. This results in the 'no proposal chosen' error because the authentication method proposed (PSK) does not match the expected method (certificate). Removing the pre-shared key from the branch firewalls' IKE gateway configuration forces them to use the certificate, aligning with the hub's configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the pre-shared key from the IKE gateway configuration on the branch firewalls.
Why this is correct
When using certificate authentication, the pre-shared key should not be configured; otherwise the IKE proposal negotiation fails.
- ✗
Change the IKE version on the hub to IKEv1.
Why it's wrong here
IKE version mismatch would cause a different error.
- ✗
Reissue the hub firewall's certificate with the correct subject name.
Why it's wrong here
The certificate subject name is not the cause; the negotiation fails due to proposal mismatch.
- ✗
Ensure the internal CA is reachable from the branch firewalls.
Why it's wrong here
Certificate revocation check is not causing the failure.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.