An enterprise uses GlobalProtect with both user- and machine-based certificate authentication and requires pre-logon, OCSP checks, and minimal user disruption. They manage multiple firewalls via…

Question

Options

• AUse a wildcard certificate from a public CA, disable all revocation checks to reduce latency, and
• BDistribute root and intermediate CAs via Panorama template, use distinct certificate profiles for
• CConfigure a single certificate profile for both user and machine certificates. Rely solely on CRLs
• DDeploy self-signed certificates on each firewall, allow IP-based authentication to override

• A
  13% (5)
• B
  78% (31)
• C
  8% (3)
• D
  3% (1)

Explanation

Answer B is correct because it addresses every requirement systematically. Distributing root and intermediate CA certificates via Panorama templates ensures all managed firewalls share a consistent, trusted certificate chain without manual per-device configuration. Using distinct certificate profiles - one for machine certificates (pre-logon tunnel) and one for user certificates (post-logon tunnel) - is required because pre-logon authenticates the machine before a user logs in, and the two stages have different certificate sources and trust requirements. OCSP checks can be enabled within the certificate profile for real-time revocation validation. Answer A disables revocation checks, violating the security requirement. Answer C uses a single profile for both types, breaking pre-logon. Answer D uses self-signed per-firewall certs and allows IP-based overrides, undermining consistent policy enforcement.

No community discussion yet for this question.