PCNSA PCNSA VPN and Tunnel Configuration 2 — Questions and Answers
Question 1: In GlobalProtect, what is the difference between a 'pre-logon' and an 'on-demand' connect method?
- Pre-logon connects before user login using machine certificates; on-demand requires the user to manually initiate the VPN (Correct answer)
- Pre-logon only works on Windows; on-demand only works on macOS
- Pre-logon uses IKEv1; on-demand uses IKEv2
- Pre-logon requires MFA; on-demand does not
Correct answer: Pre-logon connects before user login using machine certificates; on-demand requires the user to manually initiate the VPN
Pre-logon establishes a VPN tunnel before the user logs in using machine certificates, while on-demand requires the user to manually start the connection.
Question 2: Which authentication method uses digital certificates to verify the identity of both VPN peers in a Palo Alto Networks IPsec deployment?
- Pre-Shared Key (PSK)
- RSA Certificate-based authentication (Correct answer)
- RADIUS authentication
- LDAP authentication
Correct answer: RSA Certificate-based authentication
Certificate-based authentication uses RSA or ECDSA certificates signed by a trusted CA to mutually authenticate both ends of an IPsec tunnel.
Question 3: What is a 'split tunnel' configuration in GlobalProtect, and what is its primary trade-off?
- All traffic is forced through the VPN; trade-off is reduced speed
- Only traffic destined for corporate resources goes through the VPN; trade-off is that internet traffic bypasses firewall inspection (Correct answer)
- Traffic is split between two gateways for redundancy; trade-off is complexity
- DNS traffic goes through VPN but data does not; trade-off is DNS leaks
Correct answer: Only traffic destined for corporate resources goes through the VPN; trade-off is that internet traffic bypasses firewall inspection
Split tunneling routes only corporate-bound traffic through the VPN while internet traffic exits directly, reducing VPN load but leaving non-corporate traffic uninspected.
Question 4: What is 'Dead Peer Detection' (DPD) used for in Palo Alto Networks IPsec VPN tunnels?
- Detecting and blocking unauthorized VPN peers
- Monitoring peer liveness and triggering tunnel re-establishment when a peer becomes unreachable (Correct answer)
- Encrypting IKE negotiation messages
- Distributing routing information across the tunnel
Correct answer: Monitoring peer liveness and triggering tunnel re-establishment when a peer becomes unreachable
DPD periodically sends IKE hello messages to detect if the remote peer is still reachable and re-establishes the tunnel if it is not.
Question 5: Which Palo Alto Networks feature allows a GlobalProtect gateway to enforce Host Information Profile (HIP) checks?
- Security policy tag matching
- HIP-based policy enforcement (Correct answer)
- URL filtering profile
- DoS Protection profile
Correct answer: HIP-based policy enforcement
HIP-based policy enforcement uses endpoint posture data collected by the GlobalProtect agent to allow or restrict access based on device compliance.
Question 6: In a Palo Alto Networks IPsec VPN, what is an 'IPsec Tunnel' object and what must it reference?
- A physical interface; it must reference a routing protocol
- A logical configuration object for Phase 2; it must reference an IKE Gateway and a tunnel interface (Correct answer)
- A certificate object; it must reference a CA
- A security zone; it must reference a security policy
Correct answer: A logical configuration object for Phase 2; it must reference an IKE Gateway and a tunnel interface
The IPsec Tunnel object defines Phase 2 parameters and must reference an IKE Gateway (Phase 1 config) and a tunnel interface to carry the encrypted traffic.
PCNSA PCNSA VPN and Tunnel Configuration 2
In GlobalProtect, what is the difference between a 'pre-logon' and an 'on-demand' connect method?