PCNSA PCNSA VPN and Tunnel Configuration 2

Question 1

In GlobalProtect, what is the difference between a 'pre-logon' and an 'on-demand' connect method?

Accepted Answer

Pre-logon connects before user login using machine certificates; on-demand requires the user to manually initiate the VPN

Answer

Pre-logon establishes a VPN tunnel before the user logs in using machine certificates, while on-demand requires the user to manually start the connection.

Question 2

Which authentication method uses digital certificates to verify the identity of both VPN peers in a Palo Alto Networks IPsec deployment?

Accepted Answer

RSA Certificate-based authentication

Answer

Certificate-based authentication uses RSA or ECDSA certificates signed by a trusted CA to mutually authenticate both ends of an IPsec tunnel.

Question 3

What is a 'split tunnel' configuration in GlobalProtect, and what is its primary trade-off?

Accepted Answer

Only traffic destined for corporate resources goes through the VPN; trade-off is that internet traffic bypasses firewall inspection

Answer

Split tunneling routes only corporate-bound traffic through the VPN while internet traffic exits directly, reducing VPN load but leaving non-corporate traffic uninspected.

Question 4

What is 'Dead Peer Detection' (DPD) used for in Palo Alto Networks IPsec VPN tunnels?

Accepted Answer

Monitoring peer liveness and triggering tunnel re-establishment when a peer becomes unreachable

Answer

DPD periodically sends IKE hello messages to detect if the remote peer is still reachable and re-establishes the tunnel if it is not.

Question 5

Which Palo Alto Networks feature allows a GlobalProtect gateway to enforce Host Information Profile (HIP) checks?

Accepted Answer

HIP-based policy enforcement

Answer

HIP-based policy enforcement uses endpoint posture data collected by the GlobalProtect agent to allow or restrict access based on device compliance.

PCNSA - Palo Alto Networks Certified Network Security Administrator Practice Test

PCNSA - Palo Alto Networks Certified Network Security Administrator Practice Test

PCNSA PCNSA VPN and Tunnel Configuration 2