I've been using an automatic profile paradigm of Trusted and Untrusted since the feature was released, however, I've noticed some interesting behavior with Little Snitch 4 (4.0.1).
Simply put, when I'm not on my Home Network, the Untrusted profile is activated. Once I establish a VPN Connection, the Trusted profile is activated automatically. The Untrusted profile is set to Silent Mode - Deny Connections. The Trusted profile is set to Alert Mode.
I generally have the Network Monitor opened throughout the day and I've noticed that occasionally, incoming connections like Dropbox (LAN Sync) and mDNSResponder will show up with the blue inline confirmation box stating that "Connections occurred during Silent Mode...".
My understanding is that once I switch to Alert Mode, I should be alerted like normal, however, it seems like perhaps connections are persisted even after the Profile / Operation Mode transition.
If any clarity is needed, feel free to inquire.