PCNSE Manage, Monitor and Operate Practice Question
An organization is experiencing intermittent connectivity issues with their GlobalProtect remote access VPN. Users report that they can connect but after a random period (20-40 minutes) the tunnel drops and reconnects. The firewall has sufficient licensing. Which setting should be reviewed first?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between 'Idle Timeout' and 'Session Timeout' on GlobalProtect gateways, and the trap here is that candidates confuse the 'Tunnel Rekey' interval (which is a seamless process) with a timeout that causes disconnection, or they incorrectly attribute the issue to client-side network change detection rather than a server-side idle timeout.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GlobalProtect gateway 'Idle Timeout' setting.
The 'Idle Timeout' setting on the GlobalProtect gateway controls how long an inactive session is allowed to remain connected. If this value is set too low (e.g., 20-30 minutes), the gateway will terminate the tunnel after that period of inactivity, causing the client to disconnect and immediately reconnect, which matches the described symptom of intermittent drops every 20-40 minutes. This is the most likely cause because the issue is periodic and consistent with a timeout-based disconnection, not a network change or authentication failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
GlobalProtect gateway 'Idle Timeout' setting.
Why this is correct
A low idle timeout can disconnect sessions prematurely, and the client may reconnect automatically.
- ✗
The 'Disconnect on Network Change' option on the client.
Why it's wrong here
This would cause disconnection only when the network interface changes, not on a fixed schedule.
- ✗
The authentication timeout on the firewall.
Why it's wrong here
Authentication timeout affects re-authentication, but the timing (20-40 min) suggests idle timeout rather than authentication period.
- ✗
'Tunnel Rekey' interval in the IPSec configuration.
Why it's wrong here
Rekey issues often cause permanent failure, not intermittent reconnects, unless there is a crypto mismatch.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.