A network administrator wants to deploy GlobalProtect with pre-logon for Windows 10 endpoints and follow Palo Alto Networks best practices. To install the certificate and key for an endpoint, which th

A server certificate is presented by the GlobalProtect gateway to the client for server authentication, not installed on the endpoint for client authentication.

The local computer store on a Windows endpoint is the designated location for machine certificates used for system-level authentication, such as GlobalProtect pre-logon.

While a private key is an integral part of any functional certificate, the options 'machine certificate' and 'self-signed certificate' already inherently include the requirement for their corresponding private keys to be present and usable.

A self-signed certificate can function as the machine certificate for GlobalProtect pre-logon, provided it is properly generated and the GlobalProtect gateway is configured to trust it.

A machine certificate is essential for GlobalProtect pre-logon, as it allows the endpoint to authenticate with the GlobalProtect gateway before a user logs in.