PCNSA PCNSA VPN and Tunnel Configuration 1

Question 1

Which Palo Alto Networks VPN technology is used to provide secure remote access for end users connecting from laptops or mobile devices?

Accepted Answer

GlobalProtect

Answer

GlobalProtect provides secure remote access VPN for end users by establishing encrypted tunnels from their devices to the corporate network.

Question 2

What is the role of the GlobalProtect Portal in a Palo Alto Networks remote access deployment?

Accepted Answer

Authenticates users and distributes agent configuration to connecting clients

Answer

The GlobalProtect Portal authenticates users, delivers the GlobalProtect agent, and distributes configuration profiles to connecting endpoints.

Question 3

Which IKE phase is responsible for establishing a secure, authenticated channel used to negotiate IPsec security associations?

Accepted Answer

IKE Phase 1

Answer

IKE Phase 1 establishes a secure and authenticated control channel (ISAKMP SA) that is then used in Phase 2 to negotiate IPsec SAs.

Question 4

In a Palo Alto Networks IPsec VPN configuration, what is an 'IKE Gateway'?

Accepted Answer

A configuration object defining the peer VPN device and IKE parameters for Phase 1

Answer

An IKE Gateway object on PAN-OS defines the remote peer address, authentication method, and IKE version for Phase 1 negotiation.

Question 5

Which interface type must be created on a Palo Alto Networks firewall to carry IPsec tunnel traffic?

Accepted Answer

Tunnel interface

Answer

A Tunnel interface is a logical, virtual interface that serves as the endpoint for IPsec tunnels, carrying encrypted traffic between sites.

PCNSA - Palo Alto Networks Certified Network Security Administrator Practice Test