PCNSE IKE SA Practice Question
Exhibit
admin@PA-5020> show vpn ike-sa Gateway Peer Interface Role Life LifeKB State GW1 10.1.1.1 ethernet1/2 Responder 86400 0 ACTIVE GW1 10.1.1.1 ethernet1/2 Initiator 86400 0 ACTIVE GW1 10.1.1.1 ethernet1/2 Responder 86400 0 ACTIVE
Refer to the exhibit. A network engineer sees multiple IKE SAs for the same peer. What does this indicate?
⚠ Common exam trap
A common misconception is that multiple IKE SAs for the same peer always indicate multiple Phase 2 tunnels. In reality, Phase 2 tunnels do not create extra IKE SAs. Instead, multiple IKE SAs are caused by multiple IKE gateway configurations for the same peer, which is often a configuration error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A configuration error causes duplicate SAs.
In Palo Alto firewalls, each IKE gateway configuration establishes a separate IKE SA. If multiple IKE gateways are configured with the same peer IP address (e.g., duplicated or misconfigured gateways), multiple IKE SAs will appear for that peer. This typically indicates a configuration error rather than an intentional design, as each peer should usually have a single IKE gateway. Multiple Phase 2 tunnels under the same IKE gateway do not create additional IKE SAs; they only create additional Phase 2 SAs within the same IKE SA. Therefore, multiple IKE SAs for the same peer point to duplicate or erroneous IKE gateway configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A configuration error causes duplicate SAs.
Why this is correct
Correct. Multiple IKE SAs for the same peer indicate a configuration error, such as duplicate IKE gateways. When two or more IKE gateways are configured with identical peer IP settings, each gateway establishes its own IKE SA, resulting in multiple SAs.
- ✗
Multiple Phase 2 tunnels are established.
Why it's wrong here
Incorrect. Multiple Phase 2 tunnels (with different proxy IDs) exist under a single IKE SA and do not create additional IKE SAs. Only Phase 1 IKE SAs are counted, and they are tied to IKE gateways.
- ✗
Multiple Phase 1 proposals are accepted.
Why it's wrong here
Incorrect. Multiple Phase 1 proposals are not accepted simultaneously; only one proposal is selected during IKE negotiation. Multiple IKE SAs are due to multiple IKE gateways, not multiple proposals.
- ✗
The firewall is under DDoS attack.
Why it's wrong here
Incorrect. While a DDoS attack might attempt to exhaust IKE resources, multiple IKE SAs alone are not a definitive sign of attack. It is more likely a configuration issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.