Which GlobalProtect Client connect method requires the distribution and use of machine certificates?

The correct answer is B. Pre-logon. The Pre-logon connect method establishes a VPN tunnel to the GlobalProtect gateway before any user logs into the endpoint. Because no user is yet authenticated at this stage, the tunnel must be authenticated using a machine (device) certificate that uniquely identifies the…

Submitted by hans_de· Apr 18, 2026Deploy and Configure

Question

Options

AAt-boot
BPre-logon
CUser-logon (Always on)
DOn-demand

How the community answered

(56 responses)

A
2% (1)
B
93% (52)
C
4% (2)
D
2% (1)

Explanation

The Pre-logon connect method establishes a VPN tunnel to the GlobalProtect gateway before any user logs into the endpoint. Because no user is yet authenticated at this stage, the tunnel must be authenticated using a machine (device) certificate that uniquely identifies the endpoint itself. This requires pre-distributing machine certificates to managed endpoints via MDM or GPO. At-boot also connects early but does not mandate machine certificates; User-logon (Always On) uses user credentials after login; On-demand is fully user-initiated and optional.

Topics

#GlobalProtect#Pre-logon#Machine Certificates#VPN Client Authentication

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice