1.6 Configure Tunnels NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An IPSec tunnel between two Palo Alto firewalls is not coming up. The engineer checks the IKE gateway configuration and sees that the local and remote IKE versions match, and the pre-shared key is correct. The 'show vpn ipsec-sa' command shows no active SAs. What is the most likely next step to diagnose the issue?

   • AEnsure that the tunnel interface has a management profile applied.
   • BConfirm that the crypto profile uses AES-256 encryption.
   • CVerify that the tunnel interface is assigned to the correct zone.
   • DCheck the IKE debug logs to see if phase 1 negotiations are failing.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is setting up a GRE tunnel between two sites. The tunnel is configured, but traffic is not being routed through it. The engineer verifies that the tunnel interface is up and the static route is correct. What should the engineer check next?

   • AEnsure that the tunnel interface is assigned to a zone and that a security policy allows the traffic.
   • BVerify that the GRE tunnel is using the correct encapsulation protocol (GRE vs. IPIP).
   • CConfirm that the tunnel interface is using a virtual router that is different from the default.
   • DCheck that the tunnel interface has a management profile applied.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company needs to connect two branch offices over the internet using a simple tunnel that can carry multicast traffic and routing protocols like OSPF. The traffic does not require encryption. Which tunnel type should be used?

   • AL2TP tunnel
   • BSSL VPN tunnel
   • CGRE tunnel
   • DIPSec tunnel
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A GRE tunnel between two Palo Alto firewalls is not passing traffic. The tunnel interface is up, and the static route is in place. What is the most likely cause of the problem?

   • AThe GRE tunnel is not configured with a keepalive mechanism.
   • BThe tunnel interface IP address is not in the same subnet as the remote tunnel interface.
   • CThe tunnel interface is not assigned to a zone, or the security policy is blocking traffic.
   • DThe GRE tunnel is not using encryption, so the traffic is visible to attackers.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When configuring an IPSec tunnel on a Palo Alto firewall, which three components must be defined and associated with each other?

   • AVirtual router, zone, and interface management profile
   • BStatic route, NAT policy, and security policy
   • CDHCP server, DNS proxy, and NTP settings
   • DIKE gateway, IPSec crypto profile, and tunnel interface
   Reveal Solution Discussion Select an answer first