PCNSE Troubleshoot Practice Question
Which THREE are required for a successful firewall-to-firewall IPSec VPN tunnel? (Choose three.)
⚠ Common exam trap
Many exam-takers assume hardware or CA compatibility is required, but the PCNSE exam tests that only IKE parameters, authentication credentials, and proxy IDs must match—not the firewall model or a shared CA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Matching IKE version and encryption algorithms
Option A is correct because both peers must negotiate a compatible IKE version (IKEv1 or IKEv2) and agree on matching Phase 1/Phase 2 encryption, hash, authentication, and DH group algorithms, otherwise the ISAKMP/IPSec SA negotiation fails. Option D is correct because the proxy IDs (local and remote subnet selectors) must mirror each other on both firewalls; if the local subnet on one side does not match the remote subnet on the other, the tunnel will not establish or will fail to pass traffic. Option E is correct because authentication requires matching pre-shared keys or mutually trusted certificates, and a mismatch in PSK or certificate trust causes Phase 1 authentication to fail. Option B is not required because IPSec is a standards-based protocol and interoperates between different firewall vendors and models. Option C is not required because a shared certificate authority is only needed when using certificate-based authentication; PSK authentication works without any CA, and even with certificates the requirement is mutual trust, not necessarily the same CA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Matching IKE version and encryption algorithms
Why this is correct
Matching IKE version and encryption algorithms is mandatory because both peers must negotiate identical Phase 1 and Phase 2 proposals; any mismatch in IKEv1 versus IKEv2, encryption, hashing, authentication or Diffie-Hellman group causes the security association negotiation to fail, preventing the tunnel from establishing.
- ✗
Same firewall model
Why it's wrong here
IPSec is a standards-based protocol, so interoperability does not depend on matching hardware; any two compliant firewalls can form the tunnel. It is tempting because identical models do simplify configuration and troubleshooting, and would be the right consideration when managing a homogeneous estate with shared templates.
- ✗
Same certificate authority
Why it's wrong here
IPSec peers authenticate with pre-shared keys or certificates independently; a shared CA is unnecessary unless certificate-based authentication is chosen, and even then each peer can trust different roots. It is tempting because certificate authentication does require each peer to validate the other's certificate, which is correct when PKI-based authentication is the selected method.
- ✓
Matching proxy IDs (local/remote subnets)
Why this is correct
Proxy IDs define the local and remote subnets permitted through the tunnel. If the two firewalls' proxy IDs do not mirror each other, Phase 2 selectors mismatch and the IPSec security association fails to establish.
- ✓
Matching pre-shared keys or certificates
Why this is correct
Matching pre-shared keys or certificates satisfy the authentication requirement of IKE Phase 1, letting both peers verify each other's identity before negotiating the IPSec tunnel. Without identical PSKs, or certificates chaining to a mutually trusted CA, the IKE SA fails and no tunnel establishes.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.