The answer is that the GlobalProtect tunnel fails IP assignment because the gateway’s interface is not in the same subnet as the IP pool. When the GlobalProtect gateway attempts to assign an IP from the 10.10.10.100-10.10.10.200 range, it must have a local interface on that subnet to respond to ARP requests and route traffic for the tunnel; without this, the client authenticates successfully but the tunnel never establishes. On the PCNSE exam, this scenario tests your understanding of how GlobalProtect gateways handle IP pool assignment—a common trap is assuming authentication success means the tunnel should work, when in fact the gateway’s egress interface must share the pool’s subnet. Remember the memory tip: “If the pool and gateway don’t share a subnet, the tunnel won’t get set.”
PCNSE Troubleshoot Practice Question
This PCNSE practice question tests your understanding of troubleshoot. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A large organization uses GlobalProtect for remote access. Users report that they can connect to the portal and download the client, but the client fails to establish a tunnel after connecting. The firewall's GlobalProtect gateway is configured with an authentication profile that uses LDAP. The gateway is configured to use an internal IP pool. The administrator checks the GlobalProtect logs and sees that the user authenticates successfully, but the gateway fails to assign an IP address. The IP pool is configured with a range of 10.10.10.100-10.10.10.200. The administrator verifies that there are no other devices using those IPs. The gateway is on a different subnet than the IP pool. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The gateway's interface is not in the same subnet as the IP pool
The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The gateway's interface is not in the same subnet as the IP pool
Why this is correct
GlobalProtect gateway requires the IP pool to be on the same subnet as the gateway's interface for proper routing.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The GlobalProtect client is outdated
Why it's wrong here
An outdated client may cause other issues, but not specifically IP assignment failure.
✗
The LDAP authentication profile is misconfigured
Why it's wrong here
Authentication works; the issue is after authentication.
✗
The client certificate is not trusted by the gateway
Why it's wrong here
Certificate issues would prevent authentication, not IP assignment.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume IP pool assignment is independent of the gateway's interface subnet, but the gateway must have a directly connected route to the pool range for the tunnel to establish.
Detailed technical explanation
How to think about this question
The GlobalProtect gateway assigns an IP from the configured pool to the client's virtual tunnel interface. The gateway's interface must be in the same Layer 2 domain as the pool to handle ARP and routing for the assigned IP; otherwise, the gateway cannot respond to the client's DHCP-like request or forward traffic correctly. In production, this often occurs when the IP pool is from a different subnet than the gateway's external interface, and no proxy-ARP or VLAN interface is configured to bridge the subnets.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Troubleshoot — This question tests Troubleshoot — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The gateway's interface is not in the same subnet as the IP pool — The GlobalProtect gateway must have an interface in the same subnet as the IP pool to successfully assign an IP address to the client. When the gateway is on a different subnet, it cannot route or respond to ARP requests for the assigned IP, causing the IP assignment to fail even though authentication succeeds. This is a common misconfiguration because the IP pool is used for tunnel interface addressing, and the gateway's egress interface must be able to directly communicate with the pool range.
What should I do if I get this PCNSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.