PCNSE IKE SA Practice Question
Exhibit
admin@PA-5020> show vpn ike-sa Gateway Peer Interface Role Life LifeKB State GW1 10.1.1.1 ethernet1/2 Responder 86400 0 ACTIVE GW1 10.1.1.1 ethernet1/2 Initiator 86400 0 ACTIVE GW1 10.1.1.1 ethernet1/2 Responder 86400 0 ACTIVE
Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?
⚠ Common exam trap
A common misconception is that multiple IKE SAs for the same peer always indicate multiple Phase 2 tunnels. In reality, Phase 2 tunnels do not create extra IKE SAs. Instead, multiple IKE SAs are caused by multiple IKE gateway configurations for the same peer, which is often a configuration error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A configuration error causes duplicate SAs.
In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway. Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A configuration error causes duplicate SAs.
Why this is correct
Correct. Multiple IKE SAs for the same peer indicate a configuration error, such as duplicate IKE gateways. When two or more IKE gateways are configured with identical peer IP settings, each gateway establishes its own IKE SA, resulting in multiple SAs.
- ✗
Multiple Phase 2 tunnels are established.
Why it's wrong here
Incorrect. Multiple Phase 2 tunnels (with different proxy IDs) exist under a single IKE SA and do not create additional IKE SAs. Only Phase 1 IKE SAs are counted, and they are tied to IKE gateways.
- ✗
Multiple Phase 1 proposals are accepted.
Why it's wrong here
Multiple IKE SAs for one peer arise when several Phase 2 selectors or traffic flows negotiate separate child SAs, not from accepting multiple Phase 1 proposals — a single IKE SA per peer results from one successful Phase 1 exchange. Multiple Phase 1 proposals are configured to offer alternatives during negotiation, only one of which is accepted.
- ✗
The firewall is under DDoS attack.
Why it's wrong here
Multiple IKE SAs for one peer normally indicate mismatched or overlapping Phase 1 settings, such as differing proxy IDs, proposals or peer identities, causing parallel negotiations rather than a DDoS. It is tempting because floods of IKE packets resemble attack traffic, but DDoS would be the answer when volume, not SA count, is anomalous.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.