5.2 Architect GlobalProtect Connection Methods: On-Demand, User-Logon (Always on), Pre-Logon (Always On) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A retail company has 5,000 point-of-sale (POS) terminals running Windows 10. These terminals are used by cashiers who log in with a shared generic account. The security team requires that all traffic from these terminals is inspected by the firewall, but they are concerned about the performance impact of VPN on the terminals. The terminals are always on and connected to the corporate network via Ethernet. Which connection method should the architect recommend to balance security and performance?

   • AUser-logon (Always On)
   • BPre-logon (Always On)
   • CNo VPN; use a site-to-site VPN instead
   • DOn-demand
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When does a user-logon (Always On) GlobalProtect connection establish?

   • ABefore the user authenticates to the device.
   • BWhen the device boots, regardless of user login.
   • CAfter the user logs in to the device.
   • DOnly when the user manually clicks connect.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In which scenario is the on-demand connection method most appropriate?

   • AA device that must be secured before the user logs in.
   • BA remote user who needs constant, automatic VPN connectivity for all network traffic.
   • CA user who occasionally needs to access corporate resources and prefers to connect manually.
   • DA user who must be connected immediately after login to enforce security policies.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of the pre-logon (Always On) connection method?

   • ATo provide a backup connection if the primary VPN fails.
   • BTo secure the device before user authentication, enabling management and policy enforcement at boot.
   • CTo establish a connection only after the user logs in.
   • DTo allow users to manually connect when needed.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A healthcare organization deploys GlobalProtect to 1,000 Windows 10 tablets used by clinicians. The tablets are used at the bedside and are shared among multiple clinicians during a shift. The security team requires that the tablets are protected by the firewall at all times, even when no clinician is logged in (e.g., during shift changes). However, the organization also wants to ensure that clinicians can access the internet quickly after logging in, without waiting for the VPN to connect. Which connection method(s) should be configured?

   • AOn-demand
   • BPre-logon (Always On) only
   • CBoth pre-logon and user-logon (Always On)
   • DUser-logon (Always On) only
   Reveal Solution Discussion Select an answer first