PCNSE Secure Access and VPN Practice Question
An organization uses RADIUS as the primary authentication method for GlobalProtect with One-Time Password (OTP). Users can authenticate to the portal, but the gateway connection fails. The RADIUS server logs show successful authentication. What is the most likely issue?
⚠ Common exam trap
Test-takers frequently assume successful portal authentication implies the gateway inherits the same RADIUS configuration, but in GlobalProtect, the portal and gateway are separate authentication contexts requiring independent configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The gateway is not configured to use RADIUS
When RADIUS is used for GlobalProtect with OTP, the portal and gateway each require their own authentication profile configuration. Successful portal authentication but gateway failure indicates the gateway lacks a RADIUS authentication profile or is misconfigured, even though the RADIUS server logs show success for the portal. Option D is correct because the gateway must be explicitly configured to use RADIUS; otherwise, it cannot process the authentication response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The portal's authentication profile does not pass the OTP to the gateway
Why it's wrong here
The portal does not pass OTP; it authenticates the user and the gateway independently verifies.
- ✗
The RADIUS server does not return a session timeout
Why it's wrong here
Session timeout affects session duration, not authentication success.
- ✗
The firewall is not configured to allow RADIUS traffic
Why it's wrong here
If RADIUS traffic were blocked, portal authentication would also fail.
- ✓
The gateway is not configured to use RADIUS
Why this is correct
The gateway must have its own authentication profile; if not set, it may use default local authentication which fails.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.