PCNSE Secure Access and VPN Practice Question
A network security engineer is configuring a route-based IPsec VPN between two Palo Alto Networks firewalls. The engineer needs to ensure that the tunnel interface is used for dynamic routing updates and that the VPN can fail over to a backup path if the primary path goes down. Which configuration is required to achieve this?
⚠ Common exam trap
The trap here is assuming that dynamic routing protocols alone provide failover without tunnel monitoring, but they need a trigger to detect path failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a tunnel interface, assign it to a zone, and enable tunnel monitoring with a destination IP address.
A route-based VPN requires a tunnel interface to participate in dynamic routing. Tunnel monitoring detects when the primary path fails, allowing routing protocols to withdraw routes and use a backup path. This combination ensures both dynamic routing and failover, which are essential for the described requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use policy-based VPN with proxy IDs and configure multiple proxy IDs for redundancy.
Why it's wrong here
Policy-based VPNs do not use tunnel interfaces and are limited to specific proxy IDs. They do not support dynamic routing protocols natively, and multiple proxy IDs do not provide path failover. This approach would not meet the requirement for dynamic routing updates or automatic failover based on path health.
- ✗
Enable IKEv2 and configure a separate tunnel interface for each path, then use OSPF with equal-cost multipath.
Why it's wrong here
While IKEv2 and separate tunnel interfaces can be used, OSPF equal-cost multipath alone does not provide failover without additional monitoring. The scenario requires a mechanism to detect path failure and switch to backup, which is typically achieved with path monitoring or dynamic routing protocols with proper timers. This option is incomplete because it lacks the necessary failure detection.
- ✓
Configure a tunnel interface, assign it to a zone, and enable tunnel monitoring with a destination IP address.
Why this is correct
A tunnel interface is required for route-based VPN, and assigning it to a zone allows policy enforcement. Tunnel monitoring sends ICMP probes to a specified IP address; if probes fail, the tunnel is considered down, triggering failover via routing changes. This directly addresses the need for dynamic routing and failover.
- ✗
Enable IKEv1 with aggressive mode and configure multiple pre-shared keys for each path.
Why it's wrong here
IKEv1 aggressive mode is less secure and does not inherently provide failover. Multiple pre-shared keys do not enable dynamic routing or path monitoring. This configuration would not support the required dynamic routing updates or automatic failover to a backup path, making it unsuitable for the scenario.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.