GlobalProtect determines the user's location (internal or external) using a feature called Internal Host Detection (IHD). The GlobalProtect agent is configured to probe a specific, pre-defined host that is only accessible from the internal corporate network. If the agent can successfully reach this host, it determines it is on the internal network and will attempt to connect to an internal gateway. If the probe fails, the agent assumes it is on an external network. Option C, while imprecisely termed "External host detection," refers to this overall network location detection mechanism, where the inability to find an internal host leads to the conclusion of being on an external network.

A. ICMP ping to Panorama management interface: This is incorrect because the detection mechanism can be configured to use any reliable internal host, not specifically the Panorama management interface. Furthermore, the methods are HTTP/HTTPS probes or reverse DNS lookups, not ICMP pings.

B. User login credentials: This is incorrect because user credentials are used for authentication to establish the VPN tunnel, a process that occurs after the agent has already determined its network location and selected a gateway.

D. Reverse DNS lookup of preconfigured host IP: This is incorrect because it describes only one of two possible methods for Internal Host Detection. The other method is an HTTP/HTTPS connection test. Therefore, this option is too specific and not universally applicable.

---

1. Palo Alto Networks, GlobalProtect Administrator's Guide PAN-OS 10.2, "Configure Internal Host Detection."

Reference Details: This section explicitly states, "To enable the GlobalProtect app to automatically detect whether the endpoint is on the internal or external network, you can configure internal host detection." It details that the app uses the reachability of specified internal hosts to determine its location. This directly supports the core concept of location detection being the deciding factor for connecting to an internal vs. external gateway.

2. Palo Alto Networks, GlobalProtect Administrator's Guide PAN-OS 10.2, "Configure Internal Host Detection."

Reference Details: The documentation lists the two specific methods for IHD: "Send an HTTP/HTTPS request to one or more internal web servers" and "Perform a reverse DNS lookup for one or more DNS servers in the internal network." This confirms that option D is only a partial answer and that option A's method (ICMP) is incorrect.