PCNSE Secure Access and VPN Practice Question
Exhibit
Refer to the exhibit. GlobalProtect Portal Configuration: Portal Name: corp-portal Authentication Profile: LDAP_Auth Gateway: corp-gw Client Authentication: Required Internal Host Detection: 10.0.0.0/8 GlobalProtect Gateway Configuration: Gateway Name: corp-gw Tunnel Interface: tunnel.3 IPSec Crypto Profile: GP-default Client IP Pool: 192.168.1.100-192.168.1.200 Security Rules: allow all
Refer to the exhibit. A user inside the corporate network (IP: 10.1.1.5) connects to the portal. The portal detects the internal host and does not assign a gateway. However, the user still cannot access internal resources. What is the most likely issue?
⚠ Common exam trap
It's easy for candidates to assume internal host detection alone solves the problem, but they overlook the client-side 'always use the gateway' setting that overrides the portal's decision and forces tunneled traffic even for internal users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The GlobalProtect client is configured to always use the gateway.
When the GlobalProtect client is configured to 'always use the gateway,' it forces all traffic (including internal traffic) to be tunneled to the gateway even when the user is already inside the corporate network. The portal correctly detects the internal host and does not assign a gateway, but the client still attempts to send traffic through the gateway, which is not reachable or not configured to forward internal traffic back, breaking access to internal resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The gateway is not configured with a client IP pool.
Why it's wrong here
The gateway has a client IP pool.
- ✓
The GlobalProtect client is configured to always use the gateway.
Why this is correct
If the client is set to 'Always use VPN', it may still try to tunnel even when internal.
- ✗
The portal's authentication profile is incorrect.
Why it's wrong here
Authentication is not the issue.
- ✗
The portal is not configured with internal host detection.
Why it's wrong here
The exhibit shows internal host detection is configured.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.