Knowledge + Practice

CCNA Secure Access and VPN Questions

53 questions · Secure Access and VPN · All types, answers revealed

Practice these questions Domain overview All questions

1

Multi-Selecthard

Which TWO features are exclusive to GlobalProtect gateway configurations and not available on the portal?

Select 2 answers

A.Clientless VPN access.

B.Enforcement of host integrity checks.

C.Configuration of internal gateway for split tunneling.

D.Application override settings.

E.Use of SSL as a transport protocol.

AnswersB, C

Correct. Host integrity is configured on the gateway.

Why this answer

Host integrity checks (HIP) are enforced by the GlobalProtect gateway, not the portal. The gateway performs the actual assessment of the endpoint's security posture (e.g., antivirus status, patch level) during tunnel establishment, while the portal only distributes HIP profiles and collects reports. This makes option B correct.

Exam trap

The trap here is that candidates confuse the portal's role in distributing HIP profiles with the gateway's role in enforcing HIP checks, leading them to incorrectly assume HIP enforcement is a portal feature.

Practice this question →

2

MCQmedium

A company is deploying GlobalProtect with internal gateways. They want to ensure that users who are inside the corporate network connect directly to internal resources without going through the firewall. Which configuration is required?

A.Configure the portal to assign the gateway only when the user is external.

B.Set the gateway's 'Tunnel Mode' to 'No' for internal users.

C.Configure the gateway agent with internal host detection.

D.Set the portal's 'Internal Host Detection' to detect the internal network and set 'Gateway' to 'None' for the internal network.

AnswerD

When the portal detects an internal host, it can be configured to not assign a gateway, allowing direct access.

Why this answer

GlobalProtect's Internal Host Detection (IHD) feature allows the portal to detect whether a user is inside the corporate network. When the portal detects the user is internal, it can be configured to assign 'None' as the gateway, meaning the client will not establish a VPN tunnel and will connect directly to internal resources. This ensures traffic does not hairpin through the firewall.

Exam trap

The trap here is that candidates often confuse Internal Host Detection as a gateway-side feature (Option C) or think the portal can simply assign gateways based on user location without the explicit IHD check (Option A).

How to eliminate wrong answers

Option A is wrong because the portal does not assign gateways based solely on external status; it uses Internal Host Detection to decide which gateway (or none) to assign. Option B is wrong because setting the gateway's 'Tunnel Mode' to 'No' would disable the tunnel for all users assigned to that gateway, not just internal users, and would still require the client to connect to the gateway. Option C is wrong because the gateway agent does not perform Internal Host Detection; that detection is done by the portal during the initial configuration download, not by the gateway.

Practice this question →

3

MCQeasy

A remote user's GlobalProtect client disconnects every 10 minutes. What setting should the administrator check?

A.The reconnection interval on the portal.

B.The idle timeout on the authentication profile.

C.The ping interval on the gateway.

D.The UDP checksum offloading on the client.

AnswerC

Correct. Gateway ping interval defines how often keepalives are sent.

Why this answer

The GlobalProtect client uses a keepalive mechanism to maintain the VPN tunnel. The ping interval on the gateway determines how often the client sends ICMP echo requests to the gateway to verify connectivity. If the ping interval is set too high or the client fails to receive responses within the configured timeout, the client may interpret the connection as lost and disconnect.

A 10-minute disconnection pattern strongly suggests the ping interval or related timeout is misconfigured, causing the client to drop the tunnel after a period of inactivity.

Exam trap

The trap here is that candidates often confuse the reconnection interval (which controls reconnection attempts after a failure) with the ping interval (which controls keepalive pings to prevent failure), leading them to select Option A instead of the correct gateway-level keepalive setting.

How to eliminate wrong answers

Option A is wrong because the reconnection interval on the portal controls how often the client attempts to re-establish a connection after a disconnect, not the frequency of keepalive pings that prevent disconnection. Option B is wrong because the idle timeout on the authentication profile governs how long a user session can remain idle before requiring re-authentication, but it does not directly cause the VPN tunnel to drop every 10 minutes; the GlobalProtect gateway uses its own keepalive mechanism independent of authentication idle timeouts. Option D is wrong because UDP checksum offloading is a network interface feature that can cause packet corruption or drops in some scenarios, but it is not a configured setting that would cause a predictable 10-minute disconnect pattern; it is a client-side driver issue, not a GlobalProtect configuration parameter.

Practice this question →

4

Multi-Selecthard

Which THREE factors must match between two IKE peers for successful IPsec tunnel establishment? (Choose three.)

Select 3 answers

A.Dead peer detection interval

B.IKE encryption algorithm

C.IKE authentication algorithm

D.Local certificate

E.IKE version (v1 or v2)

AnswersB, C, E

The encryption algorithm must match for phase 1.

Why this answer

IKE peers must agree on the encryption algorithm (e.g., AES-256, 3DES) to protect the IKE phase 1 negotiation traffic. If the algorithms do not match, the peers cannot establish a secure SA, and the tunnel fails. This is a mandatory parameter in the IKE proposal.

Exam trap

The trap here is that candidates often confuse 'factors that must match' with 'factors that can be different'—DPD intervals and certificate requirements are not mandatory for tunnel establishment, while IKE version, encryption, and authentication algorithms are non-negotiable.

Practice this question →

5

MCQeasy

When configuring GlobalProtect with certificate authentication, a user reports that the client prompts for username and password even though the certificate is installed. What is the most likely cause?

A.The certificate is expired

B.The portal authentication profile requires both certificate and password

C.The client certificate does not match the username

D.The root CA certificate is not imported into the firewall

AnswerB

If the profile is configured for multi-factor, the client requires both certificate and password.

Why this answer

When a GlobalProtect portal authentication profile is configured to require both certificate and password, the client will prompt for username and password even if a valid certificate is present. This is because the authentication profile explicitly enforces multi-factor authentication, meaning the certificate alone is insufficient for portal authentication. The client must satisfy all configured authentication factors before proceeding.

Exam trap

The trap here is that candidates often assume a valid certificate alone should suffice for authentication, overlooking that the portal authentication profile can be configured to require additional factors like a password, which forces the client to prompt for credentials regardless of certificate validity.

How to eliminate wrong answers

Option A is wrong because an expired certificate would typically result in an authentication failure or error message, not a prompt for username and password; the client would reject the certificate outright. Option C is wrong because a certificate that does not match the username would cause a certificate validation failure or mismatch error, not a username/password prompt; the client would not fall back to credential-based authentication. Option D is wrong because if the root CA certificate is not imported into the firewall, the firewall cannot validate the client certificate, leading to a certificate validation failure, not a prompt for credentials; the connection would be rejected.

Practice this question →

6

MCQmedium

Refer to the exhibit. A user inside the corporate network (IP: 10.1.1.5) connects to the portal. The portal detects the internal host and does not assign a gateway. However, the user still cannot access internal resources. What is the most likely issue?

A.The gateway is not configured with a client IP pool.

B.The GlobalProtect client is configured to always use the gateway.

C.The portal's authentication profile is incorrect.

D.The portal is not configured with internal host detection.

AnswerB

If the client is set to 'Always use VPN', it may still try to tunnel even when internal.

Why this answer

When the GlobalProtect client is configured to 'always use the gateway,' it forces all traffic (including internal traffic) to be tunneled to the gateway even when the user is already inside the corporate network. The portal correctly detects the internal host and does not assign a gateway, but the client still attempts to send traffic through the gateway, which is not reachable or not configured to forward internal traffic back, breaking access to internal resources.

Exam trap

The trap here is that candidates assume internal host detection alone solves the problem, but they overlook the client-side 'always use the gateway' setting that overrides the portal's decision and forces tunneled traffic even for internal users.

How to eliminate wrong answers

Option A is wrong because the gateway not having a client IP pool would prevent external users from getting an IP, but the issue here is that no gateway is assigned at all, and the client is still trying to use a gateway. Option C is wrong because an incorrect authentication profile would prevent the user from logging into the portal, but the user successfully connects to the portal and is detected as internal. Option D is wrong because internal host detection is working correctly (the portal detects the internal host and does not assign a gateway), so this is not the issue.

Practice this question →

7

MCQhard

A GlobalProtect user behind the tunnel is unable to browse HTTPS websites. What is the issue?

A.The firewall's decryption policy is not applied to the tunnel

B.The decryption policy rule blocks traffic from 10.0.0.0/8

C.The user's SSL certificate is not trusted

D.The tunnel inspection required conflicts with the no-decrypt rule, causing SSL sessions to be dropped

AnswerD

When tunnel inspection is required, the firewall must decrypt all SSL traffic. A no-decrypt rule forces decryption to be skipped, causing the firewall to drop the session.

Why this answer

When a GlobalProtect tunnel is established, the firewall applies tunnel inspection to decrypt and inspect traffic inside the tunnel. If a no-decrypt rule exists (e.g., for certain traffic or users), it conflicts with the tunnel inspection requirement, causing the firewall to drop SSL sessions because it cannot both inspect and bypass decryption. This results in HTTPS websites being unreachable for the user behind the tunnel.

Exam trap

The trap here is that candidates assume the issue is a missing decryption policy (Option A) or a certificate trust problem (Option C), overlooking the specific conflict between tunnel inspection and no-decrypt rules that causes SSL sessions to be dropped.

How to eliminate wrong answers

Option A is wrong because the decryption policy is applied to the tunnel interface by default when tunnel inspection is enabled; the issue is not a missing policy but a conflict. Option B is wrong because a decryption policy blocking traffic from 10.0.0.0/8 would affect all traffic from that subnet, not specifically HTTPS browsing behind the tunnel, and the scenario describes a user behind the tunnel, not a source IP block. Option C is wrong because the user's SSL certificate is not involved in the firewall's decryption process; the firewall uses its own certificate for SSL forward proxy, and the user's browser trusts the firewall's certificate, not the user's.

Practice this question →

8

Matchingmedium

Match each security rule action to its effect.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Permits traffic matching the rule

Blocks traffic and sends a reset

Silently discards traffic without notification

Sends TCP reset to client only

Sends TCP reset to both client and server

Why these pairings

Correct matches: Allow permits traffic; Deny blocks and sends TCP reset. Drop silently blocks traffic. Common confusion is between Deny and Drop.

Practice this question →

9

MCQeasy

A network administrator configures GlobalProtect for remote users. Users report they can connect but cannot access internal resources. The firewall shows the user is connected with a valid IP. What is the most likely cause?

A.The client's local firewall is blocking traffic.

B.The GlobalProtect gateway is not configured with the correct internal DNS suffix.

C.Split tunneling is misconfigured, causing missing internal routes.

D.The authentication profile is set to require multi-factor authentication.

AnswerC

Correct. Missing routes prevent access to internal subnets.

Why this answer

When GlobalProtect users can connect and obtain a valid IP but cannot access internal resources, the most common cause is misconfigured split tunneling. If split tunneling is not properly set to route internal traffic through the VPN tunnel, the client may not have the necessary routes for internal subnets, causing traffic to be sent directly to the internet instead of through the firewall. This results in connectivity to the gateway but failure to reach internal resources.

Exam trap

The trap here is that candidates often assume a successful VPN connection with a valid IP means all routing is correct, but the PCNSE exam tests the understanding that split tunneling configuration directly controls which subnets are reachable through the tunnel, and misconfiguration can leave internal resources inaccessible despite a connected state.

How to eliminate wrong answers

Option A is wrong because the client's local firewall blocking traffic would typically prevent the GlobalProtect connection itself or cause intermittent issues, not allow a successful connection with a valid IP while blocking internal access. Option B is wrong because the internal DNS suffix is used for name resolution, not for routing; incorrect DNS suffix would cause name resolution failures but not prevent access to internal resources by IP address. Option D is wrong because requiring multi-factor authentication affects the authentication process, not post-connectivity routing; if authentication succeeds and the user is connected, MFA does not impact traffic forwarding.

Practice this question →

10

MCQmedium

A large organization uses GlobalProtect for remote access. Recently, users in the APAC region have been reporting frequent disconnections from the VPN. They can connect and authenticate, but after about 5 minutes the session drops and they must reconnect. The firewall logs show 'GlobalProtect gateway timeout' for these users. The gateway's tunnel timeout is set to 30 minutes. What is the most likely cause?

A.The GlobalProtect client's keepalive interval is set to 60 minutes

B.The portal's authentication timeout is set to 120 minutes

C.The IP pool for the gateway is exhausted

D.The internal gateway hostname cannot be resolved by the client

AnswerA

If the keepalive interval exceeds the gateway's idle timeout, the session is dropped.

Why this answer

The GlobalProtect client uses keepalive messages to maintain the tunnel with the gateway. If the keepalive interval (default 60 minutes) exceeds the gateway's tunnel timeout (30 minutes), the gateway will tear down the idle tunnel before the client sends its next keepalive, causing a 'GlobalProtect gateway timeout' and disconnection after approximately 5 minutes (the gateway's idle timeout for the tunnel). The client must reconnect because the gateway considers the session expired.

Exam trap

The trap here is that candidates often focus on the tunnel timeout value (30 minutes) and assume it is the cause, but the real issue is the mismatch between the client's keepalive interval (60 minutes) and the gateway's idle timeout, which is typically much shorter than the tunnel timeout.

How to eliminate wrong answers

Option B is wrong because the portal's authentication timeout (120 minutes) controls how long the user remains authenticated to the portal, not the tunnel session; it does not cause periodic disconnections after 5 minutes. Option C is wrong because an exhausted IP pool would prevent new connections or cause authentication failures, not drop established sessions after 5 minutes with a 'gateway timeout' log. Option D is wrong because an unresolvable internal gateway hostname would prevent the client from establishing the tunnel at all, not cause disconnections after a stable connection of 5 minutes.

Practice this question →

11

MCQmedium

A network engineer configures a tunnel interface for IPSec VPN. After committing, the interface is up but no traffic passes. The tunnel itself is established (IKEv2). What should the engineer check first?

A.The tunnel interface is in the wrong virtual router

B.The tunnel interface has no IP address

C.The tunnel interface is not assigned to a zone

D.The tunnel interface does not have a management profile

AnswerB

A tunnel interface requires an IP address to route traffic; without it, packets are not routed.

Why this answer

For an IPSec tunnel interface to pass traffic, it must have an IP address assigned. Without an IP address, the tunnel interface cannot participate in routing, and the firewall will not forward packets into or out of the tunnel, even though the IKEv2 security associations are established. The IP address is required for the tunnel to be a valid next-hop in the routing table.

Exam trap

The trap here is that candidates often assume a tunnel is functional once IKEv2 phase 1 and phase 2 SAs are established, overlooking that the tunnel interface itself must have an IP address to be routable and pass traffic.

How to eliminate wrong answers

Option A is wrong because the tunnel interface being in the wrong virtual router would prevent traffic from being routed to/from the correct VR, but the question states the interface is up and the tunnel is established; the first and most fundamental check is the IP address, not the VR assignment. Option C is wrong because a tunnel interface not assigned to a zone would cause traffic to be dropped by security policy, but the interface would still show as up and the tunnel would be established; however, the immediate symptom of 'no traffic passes' with an established tunnel is more directly caused by a missing IP address, as routing cannot function. Option D is wrong because a management profile is only needed for management access (e.g., ping, SSH) to the tunnel interface itself, not for passing data traffic through the tunnel.

Practice this question →

12

MCQmedium

A network engineer configures an IPSec tunnel with multiple proxy IDs for different subnets. After committing, only one proxy ID establishes IPsec SAs. What should the engineer check?

A.The number of concurrent tunnels allowed.

B.The IPSec crypto profile.

C.The IKE gateway mode.

D.The tunnel monitor settings.

AnswerA

Correct. The firewall may limit concurrent SAs per gateway.

Why this answer

Palo Alto Networks firewalls have a default limit on the number of concurrent IPsec tunnels. When multiple proxy IDs are configured, each proxy ID requires its own IPsec security association (SA). If the tunnel limit is reached, only the first proxy ID establishes SAs, and subsequent ones fail.

Checking and increasing the 'Number of Tunnels' setting under the tunnel interface or global IPSec configuration resolves this.

Exam trap

The trap here is that candidates often assume the issue is with crypto profile mismatches or IKE gateway settings, but Palo Alto specifically tests the knowledge that each proxy ID consumes a separate tunnel slot, and the tunnel count limit is a common misconfiguration that causes only one proxy ID to work.

How to eliminate wrong answers

Option B is wrong because the IPSec crypto profile defines encryption, authentication, and DH group parameters for the SA, but it does not control how many SAs can be established per tunnel; a misconfigured crypto profile would cause all proxy IDs to fail, not just one. Option C is wrong because the IKE gateway mode (main or aggressive) affects Phase 1 negotiation but does not limit the number of Phase 2 SAs; all proxy IDs use the same IKE SA. Option D is wrong because tunnel monitor settings control path monitoring and failover, not the establishment of multiple SAs; they would not prevent additional proxy IDs from forming SAs.

Practice this question →

13

MCQmedium

A remote user reports they cannot connect to the corporate network via GlobalProtect. The GlobalProtect client shows 'Connection failed. Unable to establish a secure connection.' The portal and gateway are configured with certificate authentication. The administrator verifies that the portal/gateway certificates are valid and not expired, and the common name matches the portal's FQDN. The client's machine time is synchronized. Which configuration misconfiguration is most likely the cause?

A.The client's GlobalProtect app is an older version that does not support TLS 1.2.

B.The gateway authentication profile is set to use RADIUS instead of certificate.

C.The portal is configured with an incorrect server certificate common name (CN) that does not match the portal's FQDN.

D.The GlobalProtect gateway is configured to require HIP match, but the user's endpoint does not meet the HIP profile.

AnswerA

An older client may not support TLS 1.2, causing the connection to fail if the gateway requires it.

Why this answer

The error 'Unable to establish a secure connection' indicates a TLS handshake failure. If the GlobalProtect client is an older version that does not support TLS 1.2, but the portal/gateway requires TLS 1.2 (as is common in modern PAN-OS configurations), the handshake will fail even though certificates are valid and time is synchronized. This is a classic version incompatibility issue where the client cannot negotiate a mutually supported TLS protocol version.

Exam trap

The trap here is that candidates often focus on certificate validity or time synchronization, but the real issue is a TLS protocol version mismatch caused by an outdated client, which is a common oversight in PAN-OS environments where TLS 1.2 is enforced.

How to eliminate wrong answers

Option B is wrong because the gateway authentication profile being set to RADIUS instead of certificate would cause authentication failure, not a TLS handshake failure; the error message specifically indicates a secure connection (TLS) issue, not an authentication rejection. Option C is wrong because the administrator has already verified that the common name matches the portal's FQDN, so this misconfiguration is ruled out by the question's premise. Option D is wrong because a HIP mismatch would result in the client being denied access after the tunnel is established, not a failure to establish a secure connection; the error occurs before any HIP check can occur.

Practice this question →

14

Multi-Selecteasy

Which TWO conditions are required for a successful GlobalProtect connection using certificate authentication?

Select 2 answers

A.The client certificate must be issued by a CA trusted by the firewall.

B.The GlobalProtect portal must have a certificate for SSL.

C.The user's browser must have the firewall's root CA certificate.

D.The firewall must have the client certificate's public key.

E.The client must have a valid username and password.

AnswersA, B

Correct. The firewall trusts the CA to validate the client certificate.

Why this answer

Certificate authentication requires the firewall to validate the client certificate against a trusted Certificate Authority (CA). The firewall maintains a list of trusted CA certificates; if the client certificate is not signed by one of these CAs, the authentication fails. This ensures the client certificate is genuine and issued by an authority the firewall trusts.

Exam trap

The trap here is that candidates often confuse certificate authentication with SSL/TLS certificate validation for the portal/gateway, thinking the client needs the firewall's root CA, or they mistakenly believe the firewall must store the client's public key, when in fact it only needs the CA's public key to verify the certificate signature.

Practice this question →

15

Multi-Selecteasy

Which TWO configurations are required on a GlobalProtect portal to enable automatic tunnel configuration for macOS clients? (Choose two.)

Select 2 answers

A.GlobalProtect client package assigned to macOS

B.Enable Automatic Tunnel

C.Gateway IP Pool configured

D.PanGPS (Pan GlobalProtect Service) enabled

E.Specify a Tunnel Interface

AnswersB, E

This setting must be enabled in the portal to allow automatic tunnel configuration.

Why this answer

Options B and E are correct. To enable automatic tunnel configuration for macOS clients, the GlobalProtect portal must have 'Enable Automatic Tunnel' checked and a tunnel interface specified. This allows the portal to push the necessary tunnel settings to macOS clients.

Option A (GlobalProtect client package) is used to distribute the client, not specifically for automatic tunnel configuration. Option C (Gateway IP pool) is a gateway setting, not a portal configuration. Option D (PanGPS) is a helper service for GPS location, not required for automatic tunnel.

Practice this question →

16

Drag & Dropmedium

Order the steps to capture traffic on a Palo Alto Networks firewall using the packet capture feature.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for packet capture on a Palo Alto Networks firewall is: first configure the capture filter to define which traffic to capture, then start the capture, generate the traffic, stop the capture to finalize the data, and finally download the capture file. This order ensures that the desired traffic is captured cleanly and the file is ready for analysis.

Practice this question →

17

MCQhard

An administrator is troubleshooting a GlobalProtect VPN where users report frequent disconnections. The administrator notices that the GlobalProtect gateway logs show 'Tunnel rekey failed' errors. What is the most likely cause?

A.The GlobalProtect app's cookie integrity is corrupted.

B.The IKE gateway's rekey lifetime is shorter than the IPSec security association lifetime.

C.The GlobalProtect client needs to be reinstalled.

D.The user-id agent is not resolving usernames correctly.

AnswerB

If the IKE rekey lifetime expires before the IPSec SA, the tunnel may be torn down unexpectedly.

Why this answer

The 'Tunnel rekey failed' error indicates that the IPsec security association (SA) rekey process failed. This most commonly occurs when the IKE gateway's rekey lifetime is shorter than the IPsec SA lifetime, causing the IKE phase 1 SA to expire before the IPsec phase 2 SA can be rekeyed. As a result, the tunnel drops and the client disconnects.

Exam trap

The trap here is that candidates often assume client-side issues (like app corruption or reinstallation) are the cause, when the error is clearly a gateway-side IPsec rekey misconfiguration.

How to eliminate wrong answers

Option A is wrong because cookie integrity corruption would cause authentication or session validation failures, not a rekey failure during IPsec SA renewal. Option C is wrong because reinstalling the client would not resolve a misconfiguration in the gateway's IKE or IPsec lifetime settings; the issue is on the server side. Option D is wrong because the user-id agent's inability to resolve usernames affects user mapping and policy enforcement, not the IPsec tunnel rekey process.

Practice this question →

18

MCQeasy

An administrator configures a GlobalProtect portal with an authentication profile that uses Kerberos. Users report they cannot connect from remote locations. What is the most likely cause?

A.The remote users' computers are not domain-joined.

B.The external gateway is not configured for Kerberos authentication.

C.The authentication profile is not configured on the gateway.

D.The GlobalProtect gateway certificate is not trusted by the client.

AnswerA

Kerberos authentication requires the client to be domain-joined to obtain a ticket.

Why this answer

Kerberos authentication relies on the client being a member of the Active Directory domain to obtain a ticket-granting ticket (TGT) from the Key Distribution Center (KDC). Remote users whose computers are not domain-joined cannot acquire or present Kerberos tickets, causing authentication to fail. This is the most common reason for connection failures when Kerberos is used for GlobalProtect portal authentication.

Exam trap

The trap here is that candidates may assume Kerberos authentication can be used for external gateways or that the issue is certificate-related, but the key is understanding that Kerberos requires domain membership and cannot work for non-domain-joined remote clients.

How to eliminate wrong answers

Option B is wrong because the external gateway does not perform Kerberos authentication; Kerberos authentication is handled by the portal, and the gateway uses the authentication cookie issued by the portal after successful authentication. Option C is wrong because the authentication profile is configured on the portal, not the gateway; the gateway relies on the portal to validate the user and does not require its own authentication profile for Kerberos. Option D is wrong because while an untrusted gateway certificate can cause connection issues, it would typically produce a certificate warning or error, not a Kerberos authentication failure; the scenario specifically points to Kerberos authentication as the root cause.

Practice this question →

19

MCQeasy

A network engineer wants to allow remote users to access internal applications via GlobalProtect, but only for specific users. Which configuration method should be used to restrict access?

A.Use user-ID on the GlobalProtect gateway.

B.Configure group mapping on the GlobalProtect portal.

C.Create a HIP profile and assign it to the gateway.

D.Configure a security policy with user-ID matching the required users.

AnswerD

Security policies can use user-ID to allow or deny traffic based on authenticated user.

Why this answer

The security policy is the enforcement point that controls access to internal applications. By configuring a security policy with user-ID matching the required users, the firewall can restrict traffic based on the authenticated user identity, ensuring only specific users can reach the internal applications via GlobalProtect.

Exam trap

The trap here is that candidates often confuse the portal and gateway functions, thinking that user or group restrictions configured on the portal (like group mapping) will control application access, when in fact the security policy on the firewall is the only place to enforce which users can access specific internal resources.

How to eliminate wrong answers

Option A is wrong because user-ID on the GlobalProtect gateway is used to map IP addresses to usernames for visibility and policy enforcement, but it does not itself restrict access; it merely provides identity information. Option B is wrong because group mapping on the GlobalProtect portal is used to define which user groups can authenticate and download the portal configuration, but it does not control access to specific internal applications after the tunnel is established. Option C is wrong because a HIP profile is used to enforce endpoint compliance (e.g., antivirus, disk encryption) and is not a method to restrict access based on specific user identity; it checks the health of the client device, not the user.

Practice this question →

20

MCQeasy

A GlobalProtect user can successfully authenticate to the portal but cannot connect to the internal gateway. The portal and gateway are configured on the same firewall. What is the most likely cause?

A.User not assigned a license

B.Incorrect gateway IP address in portal configuration

C.Gateway interface not in the same zone as portal

D.Gateway MTU mismatch

AnswerB

The portal configuration must list the correct gateway IP address; otherwise the client cannot reach the gateway.

Why this answer

When the portal and gateway are on the same firewall, the portal configuration must specify the correct IP address or FQDN for the gateway. If the gateway IP address in the portal configuration is incorrect, the client will successfully authenticate to the portal but then fail to establish a tunnel to the gateway because it cannot reach the gateway at the specified address. This is the most common cause of this symptom.

Exam trap

The trap here is that candidates often assume the issue is a zone mismatch or license problem, but the portal and gateway can be in different zones and licenses are not required for basic gateway connectivity, so the incorrect gateway IP address in the portal configuration is the precise cause.

How to eliminate wrong answers

Option A is wrong because license assignment is not required for GlobalProtect gateway connectivity; licenses are only needed for features like GlobalProtect subscription services or specific user counts, not for basic gateway authentication and tunnel setup. Option C is wrong because the portal and gateway can be in different zones; in fact, they are often placed in separate zones (e.g., portal in an untrust zone, gateway in a trust zone) and this does not prevent connectivity as long as inter-zone rules allow the traffic. Option D is wrong because an MTU mismatch would cause packet fragmentation issues or connectivity drops after the tunnel is established, not a failure to connect to the gateway after portal authentication.

Practice this question →

21

MCQmedium

A network administrator is troubleshooting an IPsec site-to-site VPN that fails to establish. IKE phase 1 completes successfully, but phase 2 fails with a 'no proposal chosen' message. Both sides have identical IKE and IPsec crypto profiles, and the pre-shared key is correct. What is the most likely cause of the failure?

A.The proxy IDs (local/remote subnets) do not match between peers

B.The tunnel is configured as route-based instead of policy-based

C.The IKE gateway's local interface is down

D.Dead peer detection is not enabled on the IKE gateway

AnswerA

Mismatched proxy IDs are the most common cause of phase 2 failure.

Why this answer

In IPsec site-to-site VPNs, IKE phase 1 establishes the secure management channel using parameters like encryption, authentication, and Diffie-Hellman groups. Phase 2 negotiates the IPsec security associations (SAs) for actual data traffic, and the 'no proposal chosen' error indicates a mismatch in the phase 2 parameters. Since both sides have identical crypto profiles and the pre-shared key is correct, the most likely cause is that the proxy IDs (local and remote subnets) do not match between peers.

Proxy IDs define the traffic selectors that each peer expects to protect; if they are misaligned, the IPsec SA negotiation fails even if all other settings are identical.

Exam trap

The trap here is that candidates often assume identical crypto profiles guarantee phase 2 success, overlooking that proxy IDs (traffic selectors) are a separate, critical parameter that must be mirrored exactly on both peers.

How to eliminate wrong answers

Option B is wrong because a route-based tunnel (using a tunnel interface) still requires matching proxy IDs or traffic selectors in the IPsec profile; the failure mode for proxy ID mismatch is the same regardless of tunnel type. Option C is wrong because if the IKE gateway's local interface were down, IKE phase 1 would not complete successfully, but the question states phase 1 completes. Option D is wrong because dead peer detection (DPD) is a keepalive mechanism for detecting peer availability and does not affect the negotiation of IPsec SAs or cause a 'no proposal chosen' error.

Practice this question →

22

MCQhard

A large enterprise uses a Palo Alto Networks firewall as the central hub for site-to-site VPN connections to 50 branch offices. Each branch office has a different subnet (e.g., 10.x.0.0/16 where x is the branch number). The VPN tunnels are configured using IKEv2 with pre-shared keys. Recently, the IT team decided to migrate to certificate-based authentication for improved security. They issued certificates from an internal CA to all branch firewalls and the hub firewall. After the migration, all tunnels failed to establish. The hub firewall logs show 'IKE negotiation failed' with error 'no proposal chosen'. The administrator checks the IKE gateway configuration on the hub: the IKE version is IKEv2, the authentication method is set to 'Certificate', and the certificate profile is configured with the root CA certificate. The administrator also verifies that the branch firewalls have the correct certificates and the hub's certificate is trusted. The branch firewalls' IKE gateways are configured with the hub's IP and pre-shared key (still configured as a fallback). What should the administrator do to resolve the issue?

A.Remove the pre-shared key from the IKE gateway configuration on the branch firewalls.

B.Change the IKE version on the hub to IKEv1.

C.Reissue the hub firewall's certificate with the correct subject name.

D.Ensure the internal CA is reachable from the branch firewalls.

AnswerA

When using certificate authentication, the pre-shared key should not be configured; otherwise the IKE proposal negotiation fails.

Why this answer

When using certificate-based authentication in IKEv2, the IKE gateway configuration must use only the certificate for authentication. If a pre-shared key is also configured, the firewall will attempt to use PSK authentication instead of the certificate, causing a mismatch with the peer expecting certificate-based authentication. This results in the 'no proposal chosen' error because the authentication method proposed (PSK) does not match the expected method (certificate).

Removing the pre-shared key from the branch firewalls' IKE gateway configuration forces them to use the certificate, aligning with the hub's configuration.

Exam trap

The trap here is that candidates assume a pre-shared key can remain as a fallback without affecting the authentication method negotiation, but in Palo Alto Networks IKEv2, the presence of a PSK overrides certificate authentication, causing a proposal mismatch.

How to eliminate wrong answers

Option B is wrong because changing the IKE version to IKEv1 would not resolve the authentication method mismatch; the issue is the authentication method, not the IKE version, and both sides are already configured for IKEv2. Option C is wrong because the hub's certificate subject name is not relevant to the 'no proposal chosen' error; the error indicates a proposal mismatch in authentication method, not a certificate validation issue. Option D is wrong because the internal CA does not need to be reachable during IKE negotiation; certificate validation uses the locally stored root CA certificate, not online CRL or OCSP checks by default, and the administrator already verified the root CA certificate is trusted.

Practice this question →

23

MCQhard

After upgrading a firewall pair from PAN-OS 9.1 to 10.0, a route-based IPsec VPN to a partner is no longer establishing. The tunnel is configured with a tunnel interface (tunnel.1) with IP 10.0.0.1/30 and the remote tunnel interface is 10.0.0.2/30. IKE phase 1 completes successfully, but phase 2 fails with 'no proposal chosen' on both sides. Both firewalls have identical IPsec crypto profiles (ESP-AES-256, SHA-256, DH-5, 1-hour lifetime). What is the most likely cause?

A.The tunnel interface IP address conflicts with another interface

B.The new PAN-OS version requires a stronger DH group for IPsec

C.The proxy ID configuration was removed during the upgrade

D.A security policy block IKE is blocking the tunnel

AnswerC

Proxy IDs are required for route-based VPNs to map traffic; if missing, phase 2 fails.

Why this answer

During a PAN-OS upgrade, proxy ID configurations for route-based IPsec VPNs can be lost or reset to default values. Since the tunnel uses a numbered tunnel interface (10.0.0.1/30), the firewall automatically generates proxy IDs based on the tunnel interface IP and remote tunnel interface IP. If the proxy IDs are missing or mismatched after the upgrade, Phase 2 fails with 'no proposal chosen' even though the crypto profiles match.

The fix is to verify and reconfigure the proxy IDs under the IPsec tunnel configuration.

Exam trap

The trap here is that candidates assume identical crypto profiles guarantee Phase 2 success, overlooking that proxy IDs (traffic selectors) must also match between peers, especially after an upgrade that may reset these settings.

How to eliminate wrong answers

Option A is wrong because a tunnel interface IP conflict would cause routing or connectivity issues, not a Phase 2 'no proposal chosen' error, which is an IKE negotiation failure. Option B is wrong because PAN-OS 10.0 does not require a stronger DH group for IPsec; DH-5 is still supported and the upgrade does not enforce DH group changes retroactively. Option D is wrong because if a security policy were blocking IKE, Phase 1 would also fail, but the question states Phase 1 completes successfully, ruling out IKE-level policy blocks.

Practice this question →

24

Multi-Selecteasy

A network engineer is configuring a new GlobalProtect gateway to provide remote access. Which TWO items are required for the gateway to function properly?

Select 2 answers

A.A certificate for the gateway

B.An authentication profile

C.An IP pool for client IP assignment

D.A split tunneling configuration

E.A clientless VPN configuration

AnswersA, C

Required to secure the TLS tunnel.

Why this answer

A certificate is required for the GlobalProtect gateway to establish a TLS/SSL VPN tunnel with the GlobalProtect client. The gateway uses this certificate to authenticate itself to clients during the TLS handshake, ensuring the client is connecting to a trusted gateway. Without a valid certificate, the client will reject the connection, and the gateway cannot function.

Exam trap

The trap here is that candidates often confuse optional features like authentication profiles or split tunneling as requirements, when in fact the core mandatory components are the gateway certificate and an IP pool for client addressing.

Practice this question →

25

MCQmedium

A multinational corporation uses GlobalProtect with multiple gateways distributed globally for load balancing. The portal has 'Enable Location Awareness' enabled and region mapping is configured to map APAC users to the APAC gateway, US users to the US gateway, etc. Recently, users in the APAC region are being redirected to the US gateway, causing high latency. The AD admin confirms that users are in the correct APAC subnets. What is the most likely misconfiguration?

A.The APAC gateway's region mapping is configured with incorrect IP subnets

B.The location awareness database is outdated for APAC IP subnets

C.The APAC gateway's IP pool is exhausted

D.The portal's 'Primary Gateway' is set to the US gateway

AnswerB

An outdated database can cause incorrect gateway assignment.

Why this answer

The portal uses a location awareness database to map client IP addresses to geographic regions. If this database is outdated for APAC IP subnets, the portal may fail to recognize APAC users correctly and redirect them to the US gateway, causing high latency. The AD admin confirms the users are in correct APAC subnets, ruling out a client-side subnet issue, so the most likely cause is a stale or incorrect location database on the portal.

Exam trap

The trap here is that candidates often confuse the portal's location awareness database (which maps client public IPs to regions) with the gateway's region mapping (which defines which gateways serve which regions), leading them to incorrectly select option A or D.

How to eliminate wrong answers

Option A is wrong because region mapping on the gateway is used to define which gateways serve which regions, not to map client IPs to regions; the portal's location awareness database handles IP-to-region mapping, and the gateway's region mapping is configured correctly per the scenario. Option C is wrong because an exhausted IP pool on the APAC gateway would cause authentication failures or inability to assign an IP, not redirection to a different gateway; load balancing and gateway selection occur before IP assignment. Option D is wrong because the 'Primary Gateway' setting on the portal is used for fallback when no other gateway is selected, not for region-based redirection; if it were set to the US gateway, all users without a region match would go there, but APAC users would still be matched to APAC if the location database were correct.

Practice this question →

26

MCQhard

A site-to-site IPsec tunnel between two Palo Alto Networks firewalls is not passing traffic. The administrator runs the 'show vpn ipsec-sa' command and sees the output in the exhibit. The remote peer is configured to use IKEv2 only. Based on the configuration, what is the most likely cause of the tunnel being in 'init' state?

A.The IKE version is incompatible.

B.The pre-shared key is incorrect.

C.The proxy IDs are mismatched with the peer.

D.The IPsec crypto profile lifetime is too short.

AnswerA

Local uses IKEv1, remote expects IKEv2; Phase 1 negotiation fails, resulting in 'init' state.

Why this answer

The 'init' state in the 'show vpn ipsec-sa' output indicates that the IPsec Security Association (SA) has not been established because the IKE phase 1 negotiation failed. Since the remote peer is configured to use IKEv2 only, and the local firewall is likely configured for IKEv1 (or both, but not matching), the IKE version mismatch prevents the initial key exchange. This is the most direct cause of the tunnel remaining in 'init' state.

Exam trap

The trap here is that candidates often assume 'init' state always indicates a pre-shared key mismatch or proxy ID issue, but in this scenario the IKE version mismatch is the root cause because the tunnel never progresses past the initial IKE exchange.

How to eliminate wrong answers

Option B is wrong because an incorrect pre-shared key would cause IKE authentication failure, which typically results in an 'IKE phase 1 failure' or 'auth fail' status, not a persistent 'init' state. Option C is wrong because mismatched proxy IDs (traffic selectors) would cause IPsec phase 2 negotiation to fail, but the tunnel would still complete IKE phase 1 and show an 'active' or 'partial' state, not 'init'. Option D is wrong because a short IPsec crypto profile lifetime would cause the IPsec SA to expire and renegotiate, but the tunnel would initially establish and show 'active' before rekeying; it would not remain stuck in 'init'.

Practice this question →

27

MCQmedium

An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?

A.show counter global | match ipsec

B.show log system

C.debug ike global on

D.debug flow basic

AnswerC

This command enables detailed IKE debug logs, showing negotiation steps.

Why this answer

'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.

Exam trap

The trap here is that candidates often confuse 'debug flow basic' (data-plane) with IKE debugging (control-plane), or assume 'show counter global' will reveal negotiation failures, when in fact counters only track post-establishment statistics and not the IKE handshake itself.

How to eliminate wrong answers

Option A is wrong because 'show counter global | match ipsec' displays aggregate IPsec packet counters (e.g., encaps/decaps, drops) but does not provide IKE negotiation details; it is useful for post-establishment traffic issues, not for debugging why SAs are missing. Option B is wrong because 'show log system' shows system-level events (e.g., admin logins, config changes) but does not capture IKE-specific debug messages; it lacks the granularity needed for protocol-level negotiation failures. Option D is wrong because 'debug flow basic' is used for debugging data-plane packet flow (e.g., session setup, NAT, routing) and does not cover IKE control-plane negotiation; it would not reveal why IKE Phase 1 or Phase 2 fails.

Practice this question →

28

MCQhard

During a security audit, it is discovered that the GlobalProtect gateway allows clients to use weak encryption algorithms. Which configuration object controls this?

A.The SSL/TLS service profile on the gateway.

B.The IPSec crypto profile associated with the gateway.

C.The GlobalProtect portal agent configuration.

D.The SSL/SSH service profile on the firewall.

AnswerB

Correct. Crypto profile defines algorithms for data encryption.

Why this answer

The GlobalProtect gateway uses IPSec to secure VPN tunnels between clients and the gateway. The IPSec crypto profile defines the encryption algorithms, authentication methods, and key exchange parameters for these tunnels. If weak encryption algorithms are allowed, it is because the IPSec crypto profile associated with the gateway is configured with those weak options.

Exam trap

The trap here is that candidates confuse the SSL/TLS service profile (used for portal/management encryption) with the IPSec crypto profile (which actually controls the VPN tunnel encryption between GlobalProtect clients and the gateway).

How to eliminate wrong answers

Option A is wrong because the SSL/TLS service profile controls the SSL/TLS settings for the management web interface and portal, not the IPSec encryption used by the GlobalProtect gateway for client VPN tunnels. Option C is wrong because the GlobalProtect portal agent configuration controls client settings like app version, timeout, and certificate validation, but does not define the encryption algorithms for the IPSec tunnel between client and gateway. Option D is wrong because the SSL/SSH service profile on the firewall controls decryption and SSH proxy settings for traffic inspection, not the IPSec encryption for GlobalProtect VPN connections.

Practice this question →

29

MCQeasy

What is the most likely cause of Phase2 being down?

A.Mismatched IKE version

B.Mismatched IPSec encryption or authentication settings

C.Wrong tunnel interface IP address

D.Incorrect pre-shared key

AnswerB

'no matching proposal' indicates the IPsec proposal parameters do not match between peers.

Why this answer

Phase 2 of an IPsec VPN tunnel establishes the IPsec security associations (SAs) for encrypting and authenticating data traffic. If the Phase 2 parameters, such as encryption algorithm (e.g., AES-256 vs. AES-128), authentication algorithm (e.g., SHA-256 vs.

SHA-1), or DH group (e.g., group 14 vs. group 2), do not match between peers, the IKEv2 or IKEv1 Quick Mode negotiation will fail, leaving Phase 2 down. This is the most common cause of a successful Phase 1 (IKE SA) but a failed Phase 2.

Exam trap

The trap here is that candidates often confuse Phase 1 and Phase 2 failures, incorrectly assuming that any mismatch in authentication or encryption settings (including pre-shared keys or IKE version) will cause Phase 2 to fail, when in fact those affect Phase 1, and only IPsec-specific transform set mismatches cause Phase 2 to be down while Phase 1 remains up.

How to eliminate wrong answers

Option A is wrong because a mismatched IKE version (e.g., IKEv1 vs. IKEv2) would cause Phase 1 to fail, not Phase 2, as the IKE version is negotiated during the initial IKE SA exchange. Option C is wrong because a wrong tunnel interface IP address (e.g., on a Palo Alto Networks firewall) would prevent the tunnel from being established at all or cause routing issues, but it does not specifically cause Phase 2 to be down while Phase 1 is up; Phase 2 uses the IP addresses already established in Phase 1.

Option D is wrong because an incorrect pre-shared key would cause Phase 1 authentication to fail (e.g., during Main Mode or Aggressive Mode), preventing Phase 2 from ever being attempted.

Practice this question →

30

MCQeasy

Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?

A.A configuration error causes duplicate SAs.

B.Multiple Phase 2 tunnels are established.

C.Multiple Phase 1 proposals are accepted.

D.The firewall is under DDoS attack.

AnswerA

Correct. Multiple IKE SAs for the same peer indicate a configuration error, such as duplicate IKE gateways. When two or more IKE gateways are configured with identical peer IP settings, each gateway establishes its own IKE SA, resulting in multiple SAs.

Why this answer

In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway.

Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.

Exam trap

A common misconception is that multiple IKE SAs for the same peer always indicate multiple Phase 2 tunnels. In reality, Phase 2 tunnels do not create extra IKE SAs. Instead, multiple IKE SAs are caused by multiple IKE gateway configurations for the same peer, which is often a configuration error.

How to eliminate wrong answers

Option A is wrong because duplicate IKE SAs are not a configuration error; they are a normal result of multiple Phase 2 tunnels. Option C is wrong because multiple Phase 1 proposals are negotiated during a single IKE SA establishment, not resulting in separate IKE SAs; only one proposal is selected per IKE SA. Option D is wrong because a DDoS attack would typically cause a flood of half-open or invalid SAs, not multiple established IKE SAs for the same peer with valid Phase 2 tunnels.

Practice this question →

31

MCQhard

An organization uses RADIUS as the primary authentication method for GlobalProtect with One-Time Password (OTP). Users can authenticate to the portal, but the gateway connection fails. The RADIUS server logs show successful authentication. What is the most likely issue?

A.The portal's authentication profile does not pass the OTP to the gateway

B.The RADIUS server does not return a session timeout

C.The firewall is not configured to allow RADIUS traffic

D.The gateway is not configured to use RADIUS

AnswerD

The gateway must have its own authentication profile; if not set, it may use default local authentication which fails.

Why this answer

When RADIUS is used for GlobalProtect with OTP, the portal and gateway each require their own authentication profile configuration. Successful portal authentication but gateway failure indicates the gateway lacks a RADIUS authentication profile or is misconfigured, even though the RADIUS server logs show success for the portal. Option D is correct because the gateway must be explicitly configured to use RADIUS; otherwise, it cannot process the authentication response.

Exam trap

The trap here is that candidates assume successful portal authentication implies the gateway inherits the same RADIUS configuration, but in GlobalProtect, the portal and gateway are separate authentication contexts requiring independent configuration.

How to eliminate wrong answers

Option A is wrong because the portal's authentication profile does not need to pass the OTP to the gateway; the gateway independently authenticates the user via its own RADIUS profile, and OTP is validated per session. Option B is wrong because a missing session timeout from RADIUS would not cause the gateway connection to fail; it would only affect session duration or re-authentication behavior. Option C is wrong because if the firewall were not configured to allow RADIUS traffic, the portal authentication would also fail, contradicting the scenario where portal authentication succeeds.

Practice this question →

32

MCQmedium

An organization uses GlobalProtect with multiple gateways for different regions. Users in the Asia region are connecting to the wrong gateway. What is the most likely cause?

A.Users are manually selecting the wrong gateway from the client.

B.The gateways are not configured with priority settings.

C.The gateway selection rules on the portal do not match the users' source IP ranges.

D.The DNS resolution for the portal returns multiple IPs in round-robin.

AnswerC

If the source IP ranges in the rules are incorrect, users may be assigned to a non-optimal gateway.

Why this answer

GlobalProtect gateway selection is primarily determined by the gateway selection rules configured on the portal. These rules evaluate the user's source IP address against defined IP ranges (or countries) to assign the appropriate gateway. If the rules do not match the users' source IP ranges in the Asia region, the portal will either fail to assign a gateway or assign a default gateway, causing users to connect to the wrong gateway.

Exam trap

The trap here is that candidates often confuse gateway priority (which controls load balancing within a region) with gateway selection rules (which control which region's gateway a user connects to), leading them to incorrectly choose Option B.

How to eliminate wrong answers

Option A is wrong because while manual selection is possible, the scenario describes users 'connecting to the wrong gateway,' which implies an automated selection failure, not user error; manual selection would require deliberate action and is not the 'most likely cause' in a multi-region deployment. Option B is wrong because priority settings on gateways control load balancing and failover order among gateways within the same region, not which region a user connects to; gateway selection is based on portal rules, not gateway priority. Option D is wrong because DNS round-robin for the portal would distribute users across multiple portal IPs, but the portal itself still enforces gateway selection rules; this would not cause users to connect to the wrong gateway unless the portal configuration is incorrect.

Practice this question →

33

Multi-Selectmedium

Which THREE troubleshooting steps should be taken when a site-to-site VPN tunnel is up but no traffic passes?

Select 3 answers

A.Verify the routing table on both firewalls.

B.Check the firewall policies for the tunnel zone.

C.Increase the IPSec SA lifetime.

D.Verify the proxy IDs on both peers match.

E.Ensure the tunnel interface is placed in a virtual router.

AnswersA, B, D

Correct. Routing must direct traffic into the tunnel.

Why this answer

Even if the VPN tunnel is up (Phase 1 and Phase 2 SAs established), traffic may still fail if the firewall does not have a route to the destination network via the tunnel interface. Without a correct route in the routing table, the firewall will drop the packet or send it out the wrong interface. Verifying the routing table ensures that the tunnel interface is the next hop for the remote subnet.

Exam trap

The trap here is that candidates assume a tunnel being 'up' guarantees traffic flow, but the PCNSE exam tests that you must separately verify routing, security policies, and proxy IDs—each of which can block traffic independently of the tunnel's control-plane state.

Practice this question →

34

MCQmedium

A company configures site-to-site VPN between two Palo Alto Networks firewalls using IKEv2. The tunnel does not come up. The administrator checks the IKE gateway configuration on both sides and sees matching pre-shared keys, IKE version, and encryption algorithms. What is the most likely remaining issue?

A.The tunnel interface is not assigned to a security zone.

B.Dead peer detection (DPD) is not configured.

C.The local and peer IP addresses are swapped on one side.

D.The MTU on the WAN interface is set too low.

AnswerC

If the local and peer IPs are reversed, the IKE negotiation will fail because the peer expects the opposite.

Why this answer

If the local and peer IP addresses are swapped on one side, the IKE gateway configuration will not match the expected endpoints. IKEv2 requires that each side's local address corresponds to the other side's peer address; a mismatch prevents the initial IKE_SA_INIT exchange from completing, as the firewalls will not recognize each other as valid peers despite matching pre-shared keys and algorithms.

Exam trap

The trap here is that candidates assume matching pre-shared keys and encryption algorithms guarantee tunnel establishment, overlooking the fundamental requirement that the IKE gateway's local and peer IP addresses must be correctly mirrored on both sides.

How to eliminate wrong answers

Option A is wrong because a tunnel interface not assigned to a security zone would prevent traffic from being processed by security policies, but it does not prevent the IKEv2 tunnel from establishing at the IKE/Phase 1 level. Option B is wrong because Dead Peer Detection (DPD) is used to monitor the liveliness of an established tunnel, not to bring it up; a missing DPD configuration does not block the initial IKE negotiation. Option D is wrong because an MTU set too low on the WAN interface could cause fragmentation issues for encapsulated packets, but it would not prevent the IKEv2 handshake from starting; the tunnel would likely come up but experience packet drops for larger payloads.

Practice this question →

35

MCQmedium

Refer to the exhibit. A firewall administrator configures an IPSec tunnel. After committing, the tunnel never becomes active. What is the most likely reason?

A.The tunnel interface is not in a zone.

B.The IKE gateway configuration is missing.

C.The proxy-id protocol should be set to '0' for all.

D.The crypto profile name is invalid.

AnswerB

Correct. Without a valid IKE gateway, the tunnel cannot establish.

Why this answer

B is correct because an IPSec tunnel requires both an IKE gateway configuration and an IPSec crypto profile to establish Phase 1 and Phase 2 security associations. Without the IKE gateway, the firewall has no peer address, authentication method, or pre-shared key to initiate IKEv1/v2 exchanges, so the tunnel remains down. The exhibit likely shows a tunnel interface and crypto profile but omits the IKE gateway object, which is mandatory for tunnel activation.

Exam trap

The PCNSE exam often tests the misconception that configuring a tunnel interface and crypto profile is sufficient for an IPSec tunnel. However, the IKE gateway is a mandatory prerequisite for Phase 1 negotiation; its absence is a frequent root cause of inactive tunnels on Palo Alto firewalls.

How to eliminate wrong answers

Option A is wrong because a tunnel interface can be placed in a zone after the tunnel is established; the zone assignment does not prevent the tunnel from becoming active, as the tunnel interface is a virtual interface that only needs a zone for policy enforcement. Option C is wrong because setting the proxy-id protocol to '0' for all would disable traffic selection and cause the tunnel to match no traffic, but the tunnel can still come up with a mismatched proxy-id; the issue here is the missing IKE gateway, not proxy-id values. Option D is wrong because an invalid crypto profile name would cause a commit error or a warning, but the tunnel would still attempt to come up if the IKE gateway existed; the question states the tunnel never becomes active, implying a missing mandatory component, not a name mismatch.

Practice this question →

36

MCQmedium

An organization has two sites connected via IPSec VPN. The tunnel is up, but ICMP traffic between sites fails. No other traffic works. The firewall policy allows any-any. What is the most likely issue?

A.The IKE phase 1 proposal is mismatched.

B.The proxy IDs (interesting traffic) are not configured correctly.

C.The IPSec crypto profile uses AES-256 and the peer uses 3DES.

D.The tunnel interface MTU is set too low.

AnswerB

Correct. Mismatched proxy IDs cause the firewall to not encrypt traffic.

Why this answer

When the IPSec tunnel is up but no traffic passes, the most common cause is misconfigured proxy IDs (also called interesting traffic selectors). Proxy IDs define which source/destination subnets are permitted through the tunnel; if they don't match on both peers, the tunnel may establish (IKE and IPsec SAs are created) but the firewall will not encrypt or forward traffic because it does not match the defined selectors. Since the firewall policy allows any-any, the issue is not a policy block, pointing directly to proxy ID mismatch.

Exam trap

The trap here is that candidates assume a tunnel being 'up' means all traffic should work, but in Palo Alto Networks, the tunnel state only reflects IKE and IPsec SA establishment, not the correctness of proxy IDs which control traffic selection.

How to eliminate wrong answers

Option A is wrong because an IKE phase 1 proposal mismatch would prevent the tunnel from coming up at all—the tunnel being up indicates phase 1 completed successfully. Option C is wrong because an IPSec crypto profile mismatch (e.g., AES-256 vs 3DES) would cause the tunnel to fail during phase 2 negotiation, not allow the tunnel to be up with no traffic. Option D is wrong because a low tunnel interface MTU would cause fragmentation or packet drops for large packets, but ICMP traffic (typically small packets) would still pass; it would not cause a complete failure of all traffic.

Practice this question →

37

MCQhard

A company integrates GlobalProtect with SAML for SSO. Users report that after authentication, they receive a 'Portal cannot be reached' error. The firewall logs show the SAML authentication succeeded. What should the administrator check?

A.The user's browser is blocking pop-ups from the portal.

B.The GlobalProtect portal agent is not set to use the correct SAML profile.

C.The SAML identity provider's certificate is not imported on the firewall.

D.The SSL/TLS service profile on the portal is not bound to the correct certificate.

AnswerD

Correct. A mismatched certificate causes the browser to block the portal after SAML.

Why this answer

The 'Portal cannot be reached' error after successful SAML authentication indicates the browser cannot establish a trusted SSL/TLS connection to the portal. The SAML authentication succeeded, so the issue is not with the SAML profile or certificate. The SSL/TLS service profile on the portal must be bound to a certificate that matches the portal's FQDN and is trusted by the client browser; otherwise, the browser will block the connection, causing this error.

Exam trap

The trap here is that candidates see 'SAML authentication succeeded' and assume the issue is with SAML configuration (e.g., profile or certificate), but the error is a post-authentication SSL/TLS handshake failure, not an authentication failure.

How to eliminate wrong answers

Option A is wrong because pop-up blockers would prevent the SAML authentication window from opening, not cause a 'Portal cannot be reached' error after authentication succeeds. Option B is wrong because the SAML authentication succeeded in the firewall logs, proving the portal agent is using the correct SAML profile. Option C is wrong because the SAML identity provider's certificate is used to validate SAML assertions, not to establish the SSL/TLS tunnel between the browser and the portal; the authentication succeeded, so this certificate is already trusted.

Practice this question →

38

MCQhard

A company wants to deploy GlobalProtect to 10,000 remote users. Which method provides the most scalable and automated distribution of the client software?

A.Web-based download from the portal.

B.Manual installation via USB.

C.Email attachment.

D.Group Policy deployment via Active Directory.

AnswerA

Correct. Users download the client from the portal, which is automated and scalable.

Why this answer

Web-based download from the portal is the most scalable and automated method because GlobalProtect portals can host the client installer and automatically push it to users when they authenticate. This eliminates manual intervention, supports thousands of concurrent downloads, and integrates with the portal's auto-update mechanism to ensure all remote users run the latest version without IT overhead.

Exam trap

The trap here is that candidates often assume Group Policy (Option D) is the most automated enterprise method, but they overlook that GlobalProtect's portal-based distribution is designed specifically for remote users who are not on the corporate network or domain-joined, making it the only truly scalable and automated option for this scenario.

How to eliminate wrong answers

Option B is wrong because manual installation via USB is not scalable for 10,000 remote users, requiring physical distribution and manual execution on each device, which is impractical and error-prone. Option C is wrong because email attachments are blocked by most enterprise email security gateways, have size limitations (typically 25 MB), and cannot be reliably distributed to 10,000 users without overwhelming mail servers and violating security policies. Option D is wrong because Group Policy deployment via Active Directory requires domain-joined devices and on-premises connectivity, which remote users often lack, and it does not support the automated, internet-based distribution that GlobalProtect portal provides.

Practice this question →

39

MCQmedium

A company wants to provide VPN access to external business partners who do not have the GlobalProtect client installed. Which VPN method should be used?

A.SSL VPN (clientless)

B.GlobalProtect with pre-logon

C.IPSec VPN

D.L2TP over IPSec

AnswerA

Clientless SSL VPN allows users to access web applications via a browser without installing software.

Why this answer

SSL VPN (clientless) is correct because it allows external business partners to access specific web-based applications or internal resources through a standard web browser without requiring any client software installation. This method uses HTTPS and SSL/TLS to encrypt the session, making it ideal for scenarios where the remote user cannot or will not install the GlobalProtect client.

Exam trap

The trap here is that candidates often confuse SSL VPN (clientless) with SSL VPN (full tunnel using GlobalProtect), assuming any SSL VPN requires a client, but clientless mode specifically eliminates that requirement.

How to eliminate wrong answers

Option B is wrong because GlobalProtect with pre-logon requires the GlobalProtect client to be installed on the endpoint, which contradicts the requirement that partners do not have the client installed. Option C is wrong because IPSec VPN typically requires a dedicated VPN client or native OS configuration, and it does not offer a clientless browser-based access method. Option D is wrong because L2TP over IPSec also requires client-side software or native OS VPN configuration and does not provide clientless access; it is commonly used for site-to-site or remote access with pre-installed clients.

Practice this question →

40

MCQhard

A firewall is configured with a GlobalProtect gateway that uses an IPSec tunnel. Remote users can connect but cannot access any resources. The administrator verifies that the tunnel is established and the client receives an IP address. What is the most likely cause?

A.The tunnel interface is not in a virtual router.

B.The firewall does not have a route to the virtual IP pool.

C.The security policy does not allow traffic from the VPN zone.

D.The IP pool for the VPN client is exhausted.

AnswerB

Without a route for the virtual IP pool, the firewall cannot route return traffic to the tunnel interface.

Why this answer

When a GlobalProtect gateway uses an IPSec tunnel, the client receives an IP address from a virtual IP pool assigned to the tunnel interface. If the firewall lacks a route to that virtual IP pool, return traffic from internal resources cannot reach the client, even though the tunnel is established and the client has an IP. This is a common misconfiguration because the tunnel interface itself does not automatically inject a route for the pool into the virtual router.

Exam trap

The trap here is that candidates assume a successful tunnel establishment and IP assignment guarantee connectivity, overlooking the separate requirement for a return route to the virtual IP pool.

How to eliminate wrong answers

Option A is wrong because the tunnel interface must be assigned to a virtual router for the IPSec tunnel to establish and for the client to receive an IP address; if it were missing, the tunnel would not come up. Option C is wrong because security policies are evaluated after routing, and if there is no route to the virtual IP pool, traffic will be dropped before reaching the policy engine, so the policy is not the primary cause. Option D is wrong because if the IP pool were exhausted, the client would not receive an IP address and would fail to connect entirely, but the question states the client does receive an IP address.

Practice this question →

41

MCQeasy

A small company has two sites connected by a policy-based IPsec VPN. Users at Site B report they cannot reach a server at Site A with IP 10.1.1.100. The firewall administrator checks the VPN monitor and sees the tunnel is active and IKE SAs are up. From the Site B firewall, a ping to 10.1.1.100 succeeds. However, a user on a PC (192.168.50.10) behind the Site B firewall cannot ping 10.1.1.100. The security policy on the Site B firewall allows traffic from trust to VPN zones. What is the most likely cause of the issue?

A.The security policy on Site B does not include the user subnet as a source VPN zone traffic

B.NAT is translating the user's IP to an incorrect address

C.The IPsec tunnel has a misconfigured proxy ID

D.The Site A firewall has a route missing for the Site B user subnet

AnswerA

The policy must have the correct source zone (trust) and destination zone (VPN) and include the user subnet.

Why this answer

The security policy on Site B must explicitly include the user subnet (192.168.50.0/24) as a source in the rule that permits traffic to the VPN zone. Even though the tunnel is up and the firewall itself can reach 10.1.1.100 (bypassing policy checks), user traffic is subject to security rules. Without the user subnet as a source, the policy drops the traffic, causing the connectivity failure.

Exam trap

The trap here is that candidates assume a working tunnel and successful ping from the firewall guarantee user traffic will work, overlooking that security policies apply per source zone and address, and the firewall's own traffic is handled differently from user traffic.

How to eliminate wrong answers

Option B is wrong because NAT is not mentioned as configured, and if it were translating the user's IP incorrectly, the firewall's own ping (from its interface IP) would also fail, but it succeeds. Option C is wrong because a misconfigured proxy ID would prevent the tunnel from establishing or cause IKE SAs to fail, but the VPN monitor shows the tunnel is active and IKE SAs are up. Option D is wrong because a missing route on Site A for the Site B user subnet would cause return traffic to fail, but the firewall's ping from Site B succeeds, indicating the route exists; the issue is on the outbound policy at Site B.

Practice this question →

42

MCQmedium

A company uses GlobalProtect with internal gateways for accessing data center resources. Users on the internal network should not use the VPN. What is the best practice configuration?

A.Use the same portal for both internal and external with a single gateway.

B.Use the Internal Gateway with a pre-logon check.

C.Set the gateway to require internal client detection via IP range exclusion.

D.Disable the GlobalProtect agent for internal IP ranges.

AnswerB

Correct. Internal Gateway automatically detects internal connectivity and skips VPN.

Why this answer

Using an Internal Gateway with a pre-logon check allows the GlobalProtect agent to detect that the user is on the internal network and skip the VPN tunnel, while still enforcing security policies. This configuration ensures that internal users do not route traffic through the VPN, avoiding unnecessary overhead and potential routing issues, while the pre-logon check verifies the user's identity before granting access to data center resources.

Exam trap

The trap here is that candidates often confuse 'internal client detection' with IP-based exclusion, but the best practice is to use a dedicated Internal Gateway with pre-logon, which is more secure and dynamic than relying on static IP ranges.

How to eliminate wrong answers

Option A is wrong because using the same portal for both internal and external users with a single gateway would force internal users to establish a VPN tunnel even when on the internal network, causing suboptimal routing and unnecessary load on the firewall. Option C is wrong because setting the gateway to require internal client detection via IP range exclusion is not a best practice; it relies on static IP ranges that can be spoofed or changed, and it does not provide the same level of granular control as an Internal Gateway with pre-logon. Option D is wrong because disabling the GlobalProtect agent for internal IP ranges would prevent the agent from enforcing security policies, such as host-information checks or HIP profiles, on internal users, leaving a security gap.

Practice this question →

43

MCQmedium

A user tries to connect to the GlobalProtect portal but receives 'Certificate validation failed'. What is the most likely missing configuration?

A.The root CA certificate is not imported into the firewall

B.The gateway's certificate is not configured

C.The user's client certificate is expired

D.The portal's certificate is not configured

AnswerD

Correct. The portal must have a valid certificate configured that the client trusts. If the certificate is missing or not properly configured, the client cannot validate the portal's identity and will display this error.

Why this answer

The 'Certificate validation failed' error occurs because the GlobalProtect portal does not have a valid certificate configured, or the client does not trust the certificate authority (CA) that signed the portal's certificate. The portal must present a certificate that the client can validate; if the portal's certificate is not configured or is self-signed without proper trust, the client cannot establish trust. Importing the root CA certificate on the firewall is for client certificate authentication, not for server certificate validation.

Exam trap

The trap here is that candidates often confuse the root CA import (which is for authenticating client certificates) with the portal's server certificate configuration (which is required for the client to trust the portal). They may incorrectly assume that a missing root CA causes the validation error, but the actual missing configuration is the portal's certificate itself.

How to eliminate wrong answers

Option B is wrong because the gateway's certificate is used for IPSec tunnel authentication after portal connection, not for the initial portal certificate validation; a missing gateway certificate would cause tunnel establishment failure, not portal validation error. Option C is wrong because the user's client certificate is used for mutual authentication (if configured) and its expiration would cause a different error like 'Client certificate invalid' or 'Authentication failed', not a generic certificate validation failure. Option D is wrong because the portal's certificate must be configured for HTTPS access; if it were missing, the portal would not be reachable at all (e.g., browser would show 'connection not secure' or fail to load), not produce a validation failure after connection attempt.

Practice this question →

44

MCQeasy

A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?

A.Define a tunnel interface with an IP address that matches the certificate subject

B.Set the gateway's IP pool to require certificate authentication

C.Configure a certificate profile in the gateway's authentication settings

D.Configure client authentication in the portal with a certificate profile

AnswerC

The gateway uses a certificate profile to validate client certificates during tunnel establishment.

Why this answer

A certificate profile must be configured in the gateway's authentication settings to enforce certificate-based authentication. This profile defines the trusted Certificate Authority (CA) and validation criteria (e.g., CRL checking, OCSP), ensuring only clients presenting a valid certificate issued by that CA can establish a GlobalProtect tunnel. Without this, the gateway would fall back to username/password or other configured authentication methods.

Exam trap

The trap here is that candidates often confuse portal authentication settings with gateway authentication settings, assuming that configuring a certificate profile on the portal will automatically enforce certificate-based access on the gateway, but the gateway requires its own separate authentication configuration.

How to eliminate wrong answers

Option A is wrong because a tunnel interface IP address does not need to match the certificate subject; the certificate subject is used for identity mapping, not for IP assignment. Option B is wrong because the IP pool is used for assigning client IP addresses from a defined range, not for requiring certificate authentication; certificate enforcement is handled separately in the authentication profile. Option D is wrong because client authentication in the portal controls web-based access to the portal interface, not the gateway tunnel; gateway authentication settings are independent and must be configured directly on the gateway.

Practice this question →

45

MCQhard

A company wants to use GlobalProtect with pre-logon (user unknown). After configuration, users report that they can authenticate but cannot access the gateway during pre-logon. Which configuration item is most likely missing?

A.Pre-logon token not enabled on the portal

B.Gateway's certificate not imported or untrusted

C.Pre-logon token not enabled on the gateway

D.Portal's authentication profile does not allow pre-logon

AnswerB

If the gateway's certificate is not trusted, the client will reject the connection during pre-logon.

Why this answer

During pre-logon, the GlobalProtect gateway must present a trusted certificate to the client before any user authentication occurs, because the user is unknown and the client cannot rely on user credentials to validate the gateway. If the gateway's certificate is not imported or is untrusted, the client will reject the SSL/TLS handshake, preventing access even though portal authentication succeeds. This is the most common cause of pre-logon connectivity failure after portal authentication works.

Exam trap

The trap here is that candidates confuse the pre-logon token (a gateway setting for token-based pre-logon) with certificate trust issues, assuming the token must be enabled on the portal, when in fact the certificate trust failure is the root cause of the gateway access problem.

How to eliminate wrong answers

Option A is wrong because the pre-logon token is a gateway-level setting, not a portal setting; the portal controls authentication and configuration download, but the token for pre-logon is configured on the gateway. Option C is wrong because the pre-logon token being enabled on the gateway is necessary for the client to obtain a token, but the question states users can authenticate, implying the token exchange works; the issue is that the client cannot access the gateway, which points to a certificate trust problem. Option D is wrong because the portal's authentication profile does not control pre-logon behavior; pre-logon is configured on the gateway, and the portal's authentication profile only affects user authentication after the gateway connection is established.

Practice this question →

46

Multi-Selectmedium

Which TWO are required for a GlobalProtect gateway to establish an IPSec tunnel with a remote client?

Select 2 answers

A.Client certificate

B.Security zone for the tunnel interface

C.Tunnel interface

D.GlobalProtect portal configuration

E.IKE gateway configuration

AnswersC, E

The tunnel interface is the endpoint for the VPN traffic.

Why this answer

A tunnel interface is required on the firewall to terminate the IPSec tunnel from the remote GlobalProtect client. The tunnel interface serves as the logical endpoint for the encrypted traffic, allowing the firewall to apply security policies and route decrypted traffic appropriately. Without a tunnel interface, the IPSec security associations cannot be mapped to a virtual interface for traffic processing.

Exam trap

The trap here is that candidates often confuse the GlobalProtect portal configuration as a prerequisite for the IPSec tunnel, but the portal is only needed for client configuration and certificate provisioning, not for the actual tunnel establishment between the gateway and the remote client.

Practice this question →

47

Multi-Selecteasy

Which TWO of the following are supported authentication methods for IPSec VPN tunnel setup between two Palo Alto Networks firewalls?

Select 2 answers

A.Certificate

B.RADIUS

C.SAML

D.LDAP

E.Pre-shared key

AnswersA, E

Certificate authentication is supported for IPSec tunnels.

Why this answer

Palo Alto Networks firewalls support certificate-based authentication for IKEv1 and IKEv2 IPsec VPN tunnels, where each peer presents an X.509 certificate signed by a trusted CA. This method provides strong mutual authentication and is commonly used in large-scale or high-security deployments.

Exam trap

The trap here is that candidates confuse user authentication methods (RADIUS, SAML, LDAP) with device-to-device IPsec tunnel authentication, which only supports pre-shared keys and certificates on Palo Alto firewalls.

Practice this question →

48

Multi-Selecthard

Which THREE are valid methods for configuring a site-to-site VPN on a Palo Alto Networks firewall?

Select 3 answers

A.Policy-based VPN using a tunnel monitor

B.GlobalProtect Gateway configuration

C.Route-based VPN using a virtual router and static route

D.SSL VPN using GlobalProtect portal

E.Tunnel interface with IPSec tunnel configuration

AnswersA, C, E

Policy-based VPN uses security policies to define interesting traffic.

Why this answer

A policy-based VPN on Palo Alto Networks uses a tunnel monitor to verify the health of the IPSec tunnel by sending ICMP probes to the peer's tunnel IP address. This allows the firewall to detect tunnel failures and trigger failover or route changes, which is a standard method for site-to-site VPN configuration.

Exam trap

The trap here is that candidates confuse remote access VPN methods (GlobalProtect Gateway and Portal) with site-to-site VPN methods, leading them to select options B or D, which are exclusively for client-to-site connectivity.

Practice this question →

49

MCQhard

Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?

A.The IKE gateway is not configured with the correct peer IP.

B.No security policy allows traffic from the VPN zone.

C.The proxy IDs do not match the remote peer.

D.The tunnel interface is not assigned to a zone.

AnswerB

Even though the tunnel is up, traffic can be blocked by security policy if no rule permits it.

Why this answer

When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.

Exam trap

Palo Alto Networks often tests the misconception that a tunnel being up automatically means traffic will pass, but Palo Alto Networks requires an explicit security policy to permit decrypted traffic from the VPN zone.

How to eliminate wrong answers

Option A is wrong because if the IKE gateway had an incorrect peer IP, the tunnel would not come up at all (IKE phase 1 would fail). Option C is wrong because mismatched proxy IDs would cause IPsec SA negotiation to fail, preventing the tunnel from reaching an up state. Option D is wrong because a tunnel interface not assigned to a zone would cause the interface itself to be inactive, and the tunnel would not show as up; the question states the tunnel is up, so the interface must be zoned.

Practice this question →

50

MCQhard

A GlobalProtect user cannot connect to any resources after authenticating successfully. Portal and gateway configurations appear correct. What is the most likely issue?

A.The user's GlobalProtect client software is outdated

B.The gateway's 'Allow Access' list does not include the user

C.The gateway's interface is not in the same zone as the portal

D.The portal's 'Access' list does not include the user

AnswerB

The gateway can restrict access based on user or group; if the user is not allowed, the connection is dropped.

Why this answer

After successful authentication, the GlobalProtect gateway controls access to resources via the 'Allow Access' list. If the user is not included in this list, the gateway will not assign an IP address or push routes, effectively blocking all resource access even though authentication succeeded. This is a common post-authentication authorization check distinct from portal-level access.

Exam trap

The trap here is confusing the portal's 'Access' list (which controls initial client configuration download) with the gateway's 'Allow Access' list (which controls post-authentication resource access), leading candidates to incorrectly select option D.

How to eliminate wrong answers

Option A is wrong because an outdated GlobalProtect client typically causes connection failures or feature incompatibilities, but the user authenticated successfully, indicating the client version is compatible with the gateway. Option C is wrong because the portal and gateway interfaces do not need to be in the same zone; they are separate components that can reside in different zones, and this would not cause post-authentication resource access failure. Option D is wrong because the portal's 'Access' list controls who can download the client configuration and connect to the portal, not access to resources through the gateway; the user already authenticated to the portal successfully.

Practice this question →

51

Multi-Selecthard

Which THREE of the following are capabilities of GlobalProtect Host Information Profile (HIP)?

Select 3 answers

A.Check the user's location

B.Check the browser version

C.Check if antivirus is installed and running

D.Check if disk encryption is enabled

E.Check the operating system version

AnswersC, D, E

HIP can verify antivirus status.

Why this answer

GlobalProtect Host Information Profile (HIP) is designed to collect endpoint security posture data, such as antivirus status, disk encryption status, and operating system version. Option C is correct because HIP can check whether antivirus software is both installed and actively running, which is a standard HIP check for compliance.

Exam trap

The trap here is that candidates often confuse HIP with GlobalProtect's location-based features or application-level checks, assuming HIP can verify user location or browser versions, when in reality HIP is strictly focused on endpoint security posture attributes like OS, antivirus, disk encryption, and patch management.

Practice this question →

52

Multi-Selectmedium

Which THREE of the following are valid configuration elements for a tunnel interface in Palo Alto Networks?

Select 3 answers

A.Zone

B.IP address

C.Traffic shaping policy

D.Management Profile

E.Netflow profile

AnswersA, B, D

A tunnel interface must be assigned to a zone for security policy.

Why this answer

Every tunnel interface in Palo Alto Networks must be assigned to a security zone. The zone determines which security policies apply to traffic entering or leaving the tunnel, and without a zone assignment, the tunnel interface cannot pass traffic. This is a mandatory configuration element for any Layer 3 interface, including tunnel interfaces.

Exam trap

The trap here is that candidates often assume traffic shaping or Netflow can be applied directly to tunnel interfaces, confusing them with physical interfaces or security rules, but PAN-OS restricts these features to specific configuration objects like QoS policies or dataplane-level Netflow monitoring.

Practice this question →

53

MCQeasy

An administrator configures a VPN tunnel between two Palo Alto firewalls. The tunnel shows as active, but traffic is not being encrypted. What configuration step is most likely missing?

A.The encryption algorithm must be set to null.

B.A NAT policy to translate private addresses.

C.A security policy allowing traffic from the tunnel interface to the destination.

D.The tunnel interface must be assigned to a security zone.

AnswerC

Correct. Without a policy, traffic is dropped.

Why this answer

Even when a VPN tunnel is active (Phase 1 and Phase 2 SAs are established), traffic will not be encrypted unless a security policy explicitly permits traffic from the tunnel interface to the destination zone. On Palo Alto firewalls, inter-zone traffic requires a security policy to allow the session; without it, the firewall drops the traffic before it can be encrypted and sent over the tunnel. The tunnel being up only indicates IKE/IPsec negotiation succeeded, not that data-plane forwarding is authorized.

Exam trap

The trap here is that candidates assume an active VPN tunnel automatically encrypts all traffic routed to it, overlooking that Palo Alto firewalls enforce security policies as a prerequisite for any inter-zone traffic, including traffic destined for a tunnel interface.

How to eliminate wrong answers

Option A is wrong because setting the encryption algorithm to null would disable encryption entirely, which is the opposite of what is needed to encrypt traffic; null encryption is rarely used and would not cause a missing encryption issue. Option B is wrong because NAT policies translate private addresses for internet-bound traffic, but in a site-to-site VPN between two Palo Alto firewalls, private addresses are typically routed directly over the tunnel without NAT; adding NAT would break the routing and is not required for encryption. Option D is wrong because the tunnel interface must be assigned to a security zone for the firewall to apply security policies and route traffic; if it were unassigned, the tunnel would not be usable at all, and the administrator would likely see the tunnel as down or traffic would not be routed, not just unencrypted.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Secure Access and VPN questions.

Start 20-question session