PCNSE Manage, Monitor and Operate Practice Question
After upgrading a PA-5250 from PAN-OS 9.1 to PAN-OS 10.1, the firewall fails to establish IPsec VPN tunnels with remote peers. The crypto profiles and IKE gateways appear unchanged. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume unchanged crypto profiles and IKE gateways mean no configuration issue, overlooking the silent enforcement of a new default PSK length requirement introduced in PAN-OS 10.1.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IKEv2 default configuration now requires a pre-shared key minimum length of 32 characters.
In PAN-OS 10.1, the default minimum pre-shared key length for IKEv2 was increased to 32 characters. If the existing PSK is shorter than 32 characters, the firewall will reject it during IKE negotiation, causing the tunnel to fail even though the crypto profiles and IKE gateways appear unchanged. This is a common compatibility issue when upgrading from PAN-OS 9.1, which had no such minimum length requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The default SSL/TLS service profile changed, affecting management access.
Why it's wrong here
This would affect management GUI/API, not IPsec tunnels.
- ✓
The IKEv2 default configuration now requires a pre-shared key minimum length of 32 characters.
Why this is correct
PAN-OS 10.1 enforces a minimum PSK length of 32 characters for IKEv2; shorter keys cause negotiation failure.
- ✗
The upgrade reset the IKE gateway configuration to default.
Why it's wrong here
Upgrades preserve running configuration; config reset does not occur.
- ✗
The firewall's management IP address changed during the upgrade.
Why it's wrong here
Management IP is not typically altered by an upgrade.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.