Palo Alto Networks Certified Network Security Engineer (PCNSE)Manage and OperateMedium
A company is implementing a new GlobalProtect VPN solution for their remote users. They require that internal resources are only accessible if the user's endpoint meets specific security requirements, such as having up-to-date antivirus software and a firewall enabled. Which GlobalProtect component is primarily responsible for enforcing these endpoint security checks before allowing full network access?
- AAuthentication Profile
- BHost Information Profile (HIP)
- CGlobalProtect Portal
- DGlobalProtect Gateway
Show answer & explanationAnswer & explanation
Correct answer: B. Host Information Profile (HIP)
The Host Information Profile (HIP) is specifically designed to collect detailed security posture information from endpoint devices and enforce policies based on that information, ensuring endpoints meet compliance requirements before granting network access.
Why the other options are wrong
- A. An Authentication Profile verifies user credentials but doesn't check the endpoint's security posture.
- C. The GlobalProtect Portal authenticates users and delivers configurations but doesn't enforce endpoint posture.
- D. The GlobalProtect Gateway terminates the VPN tunnel and applies security policies but relies on HIP for endpoint posture enforcement.
GlobalProtect HIP
Host Information Profile (HIP) is a GlobalProtect feature that collects host security state information, such as OS, patch level, antivirus status, and firewall status, from the connected endpoint.
- Collects endpoint security posture details.
- Used to enforce access based on compliance.
- HIP objects and profiles are configured on the firewall.
Memory trick: HIP checks if your host is 'HIP' enough for the network party.