PCNSE Secure Access and VPN Practice Question
A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?
⚠ Common exam trap
Many exam-takers confuse the portal and gateway functions, thinking that user or group restrictions configured on the portal (like group mapping) will control application access, when in fact the security policy on the firewall is the only place to enforce which users can access specific internal resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a security policy with user-ID matching the required users.
The security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use user-ID on the GlobalProtect gateway.
Why it's wrong here
User-ID on the gateway is used to map IPs to users, but access control is done via security policies.
- ✗
Configure group mapping on the GlobalProtect portal.
Why it's wrong here
Group mapping on the portal is for authentication, not access control.
- ✗
Create a HIP profile and assign it to the gateway.
Why it's wrong here
HIP profiles are for endpoint posture, not user-based access.
- ✓
Configure a security policy with user-ID matching the required users.
Why this is correct
Security policies can use user-ID to allow or deny traffic based on authenticated user.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?
hard- A.The user's GlobalProtect client software is outdated
- ✓ B.The gateway's 'Allow Access' list does not include the user
- C.The gateway's interface is not in the same zone as the portal
- D.The portal's 'Access' list does not include the user
Why B: After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.