PCNSE Securing Users and Applications with Authentication — 10 Questions

Question 1

A company wants to enforce MFA for VPN users but allow users to authenticate without MFA when connecting from the corporate office. Which authentication policy configuration achieves this?

Accepted Answer

Create an authentication policy with source zone 'Corporate' set to 'allow' and authentication method 'no MFA'. It creates an authentication policy that explicitly allows users from the 'Corporate' source zone to authenticate without MFA by setting the authentication method to 'no MFA'. This meets the requirement of enforcing MFA for VPN users (typically from untrusted zones) while exempting corporate office users. The authentication policy evaluates the source zone and applies the specified authentication method, overriding the global authentication profile for matching traffic.

Answer

Disable MFA in the global Authentication Profile

Answer

Create an authentication policy with source zone 'Corporate' set to 'require MFA'

Answer

Create an authentication policy with source zone 'Corporate' set to 'no-auth' and action 'allow'

Question 2

A network administrator needs to authenticate users accessing the internet through the firewall using Active Directory credentials. Which authentication method should be used to transparently authenticate users without requiring a browser-based captive portal?

Accepted Answer

Kerberos. Kerberos is the correct choice because it enables transparent, single sign-on (SSO) authentication in a Windows Active Directory domain. When a user logs into their domain-joined workstation, Kerberos obtains a Ticket-Granting Ticket (TGT) from the Key Distribution Center (KDC). The firewall can then use Kerberos authentication to verify the user's identity without requiring any browser-based captive portal, as the TGT or service ticket is presented automatically by the client.

Answer

LDAP

Answer

NTLM

Answer

SAML

Question 3

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

Accepted Answer

The 'allow-list' is restricting authentication to only user1 and user2. The authentication profile includes an 'allow-list' that explicitly restricts authentication to only 'user1' and 'user2'. When a user from the 'EXAMPLE' domain attempts to authenticate, the firewall checks the allow-list first; since the user is not in that list, the authentication fails with the 'user not found' error, even if the user exists in the domain.

Answer

The Kerberos server profile 'KDC-Profile' is misconfigured

Answer

The expiration time of 60 minutes is too short

Answer

The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

Question 4

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

Accepted Answer

Increase the SAML authentication timeout to 120 seconds. Increasing the SAML authentication timeout to 120 seconds accommodates delays in Microsoft Entra ID response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Answer

Implement a secondary IdP as a fallback

Answer

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Answer

Switch to certificate-based authentication instead of SAML

Question 5

You are a network security engineer for a multinational corporation with users in different regions. The company uses GlobalProtect for remote access and requires multi-factor authentication (MFA) using a mobile app for all users. Recently, users in the Asia-Pacific region have reported intermittent failures when authenticating via GlobalProtect. The symptoms include: after entering credentials on the GlobalProtect portal, the authentication challenge from the MFA provider times out after 30 seconds, and the user is disconnected. Users in other regions do not experience this issue. The GlobalProtect gateways and portals are configured with Authentication Profile that uses an LDAP server for primary authentication and an MFA vendor as authentication sequence. The MFA provider sends push notifications to users' mobile devices. The firewall logs show no errors related to LDAP or MFA, but the GlobalProtect logs indicate authentication timeouts. The firewall is located in the central data center, and the MFA provider's servers are in the United States. What should you do to resolve this issue?

Accepted Answer

Increase the authentication timeout in the GlobalProtect portal and gateway configuration from 30 seconds to 60 seconds.. The authentication timeout in the GlobalProtect portal and gateway configuration defaults to 30 seconds, which is insufficient when high latency exists between the firewall (central data center) and the MFA provider's servers (United States). Users in the Asia-Pacific region experience additional network latency, causing the MFA push notification challenge to exceed the 30-second timeout. Increasing the timeout to 60 seconds accommodates this latency without altering the authentication method or requiring additional infrastructure.

Answer

Change the authentication sequence to use a shorter MFA method like SMS instead of push notifications.

Answer

Disable MFA for the Asia-Pacific region users temporarily until the MFA provider improves their latency.

Answer

Deploy a secondary MFA server instance in the Asia-Pacific region to reduce latency.

Question 6

An organization wants to enforce multi-factor authentication (MFA) for administrative access to the Palo Alto Networks firewall. Which TWO authentication methods are supported for local administrator accounts?

Accepted Answer

One-time password (OTP) via RADIUS. Option C is correct because the Palo Alto Networks firewall supports one-time password (OTP) authentication for local administrator accounts via a RADIUS server, where the firewall sends the OTP challenge and the RADIUS server validates it, providing a true second factor for MFA. Option D is correct because the firewall natively supports Time-based One-Time Password (TOTP) for local administrator accounts, allowing administrators to enroll a TOTP token (e.g., via Google Authenticator) and combine it with their password for MFA. Options A and B are incorrect because LDAP and SAML IdP authentication are external directory/identity-provider methods used for administrator authentication, not local account MFA mechanisms on the firewall itself. Option E is incorrect because client certificate authentication is a separate certificate-based authentication method and is not one of the supported MFA methods for local administrator accounts in this context.

Answer

LDAP authentication

Answer

SAML IdP authentication

Answer

Client certificate authentication

Question 7

Refer to the exhibit. A firewall administrator created a local user group named 'Engineering' and added two users. However, when applying a security policy that uses this group as the source user, only one user (asmith) is matched correctly. What is the most likely cause of this issue?

Accepted Answer

The group type is set to 'local' but the users are sourced from LDAP; change the group type to 'ldap'.. When a local user group is created on the firewall, the group type must match the source of its members. If the group type is set to 'local', the firewall expects the users to be defined locally on the firewall itself. However, if the users are actually sourced from an external LDAP directory, the group type must be changed to 'ldap' so that the firewall queries the LDAP server for group membership. The mismatch causes the firewall to fail to resolve the LDAP users as members of the local group, resulting in only locally defined users (like asmith) being matched correctly.

Answer

The group should be configured as 'local' and the users should be added manually via CLI.

Answer

The user-id agent timeout is too short; increase the timeout value.

Answer

The group must be imported from LDAP as a dynamic group.

Question 8

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

Accepted Answer

The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.. The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Answer

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Answer

The authentication sequence should be reversed to 'LDAP, PingID'.

Answer

The PingID server certificate is not trusted; import the CA certificate.

Question 9

An administrator configures an authentication policy to require authentication for the 'ssl' application. After committing, the firewall does not prompt users for credentials when they access HTTPS sites. Which step is most likely missing?

Accepted Answer

The authentication policy must be placed before the security rule that allows the web-browsing traffic.. When an authentication policy is configured for the 'ssl' application, the firewall must identify the traffic as matching that rule before it reaches the security policy processing. Authentication policies are evaluated prior to security policies, but they exist in a separate rulebase. If the authentication policy rule is not correctly ordered within its own rulebase, or if it is not properly matched, the firewall will proceed to the security policy and possibly allow the traffic without authentication. One common oversight is not placing the authentication policy rule in a position where it will be evaluated before the traffic is permitted by a broad security rule, such as one allowing web-browsing. In this case, the authentication policy must be placed before the security rule that allows web-browsing traffic, meaning it must be processed first in the firewall's evaluation order.

Answer

The authentication policy is placed in the pre-rulebase but the security policy is in post-rulebase.

Answer

The 'ssl' application must have a custom signature defined.

Answer

The user-ID agent is not set to capture HTTPS traffic.

Question 10

A security administrator notices that users are able to bypass authentication by accessing resources using IP addresses instead of FQDNs, even though authentication policies are configured. How can this be prevented?

Accepted Answer

Configure an authentication policy with source user 'unknown' to enforce authentication for all unmapped IP addresses.. When users access resources by IP address rather than FQDN, the firewall cannot associate the traffic with a specific user via normal authentication policies (which rely on domain-based rules). By configuring an authentication policy with source user 'unknown', the firewall forces authentication for all unmapped IP addresses, ensuring that even IP-based access triggers user identification and policy enforcement.

Answer

Create a decryption policy to decrypt all traffic.

Answer

Use identity-based routing to enforce authentication.

Answer

Enable user-ID on the ingress interface and configure authentication policy for IP addresses.