PCNSE Securing Users and Applications with Authentication — 15 Questions

Question 1

A company has configured multi-factor authentication (MFA) via an authentication sequence using LDAP and RADIUS. Users authenticate successfully with LDAP but the MFA prompt from RADIUS does not appear. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authentication sequence must be configured to 'require all' or 'continue on success' to enforce each factor.. When using an authentication sequence in Palo Alto Networks firewalls, the sequence must be configured with the 'require all' or 'continue on success' option to enforce each factor in order. With 'continue on success', after LDAP succeeds, the firewall proceeds to the next factor (RADIUS MFA). If the sequence is set to 'continue on failure' (the default), the firewall stops after the first successful authentication and never attempts the second factor, so the MFA prompt never appears.

Answer

The RADIUS server profile has the wrong shared secret.

Answer

The authentication policy only covers HTTP applications.

Answer

The authentication sequence is set to 'continue on failure' and the LDAP authentication succeeds.

Question 2

A network engineer is troubleshooting an authentication issue where users in a specific group are not being prompted for credentials, even though the authentication policy matches their traffic. The firewall logs show that the traffic is allowed by the security policy. What is the most likely cause?

Accepted Answer

The authentication policy is placed after the security rule that allows the traffic.. When an authentication policy matches traffic but users are not prompted for credentials, the most likely cause is that the authentication policy is placed after the security rule that allows the traffic. In Palo Alto Networks firewalls, policies are evaluated in order, and if a security rule permits the traffic before the authentication policy is reached, the session is allowed without requiring authentication. The authentication policy must be placed before the relevant security rule to intercept the traffic and prompt for credentials.

Answer

The users are in a group that is excluded from authentication in the authentication profile.

Answer

The captive portal is not enabled on the interface.

Answer

The user-ID agent is not configured to include that group.

Question 3

A company wants to enforce MFA for VPN users but allow users to authenticate without MFA when connecting from the corporate office. Which authentication policy configuration achieves this?

Accepted Answer

Create an authentication policy with source zone 'Corporate' set to 'allow' and authentication method 'no MFA'. It creates an authentication policy that explicitly allows users from the 'Corporate' source zone to authenticate without MFA by setting the authentication method to 'no MFA'. This meets the requirement of enforcing MFA for VPN users (typically from untrusted zones) while exempting corporate office users. The authentication policy evaluates the source zone and applies the specified authentication method, overriding the global authentication profile for matching traffic.

Answer

Disable MFA in the global Authentication Profile

Answer

Create an authentication policy with source zone 'Corporate' set to 'require MFA'

Answer

Create an authentication policy with source zone 'Corporate' set to 'no-auth' and action 'allow'

Question 4

After configuring SAML authentication for GlobalProtect, users report they are repeatedly prompted for credentials even though they already authenticated via the IdP. The firewall logs show 'saml-auth-success' but the portal log shows 'user-login-failure: invalid saml assertion'. What is the most likely cause?

Accepted Answer

The firewall and IdP system clocks are out of sync. The firewall logs show 'saml-auth-success' (meaning the IdP successfully authenticated the user and issued a SAML assertion), but the portal log shows 'user-login-failure: invalid saml assertion'. This indicates the firewall received the assertion but rejected it as invalid. The most common cause for a validly signed assertion to be rejected is clock skew between the firewall and the IdP, because SAML assertions contain timestamps (NotBefore and NotOnOrAfter conditions) that are checked against the local system clock. If the clocks differ by more than the allowed skew (typically 5 minutes), the assertion is considered invalid even though it was correctly signed.

Answer

The IdP does not support IdP-initiated SAML flow

Answer

The user mapping agent is not configured

Answer

The SAML identity provider certificate is expired

Question 5

A network administrator needs to authenticate users accessing the internet through the firewall using Active Directory credentials. Which authentication method should be used to transparently authenticate users without requiring a browser-based captive portal?

Accepted Answer

Kerberos. Kerberos is the correct choice because it enables transparent, single sign-on (SSO) authentication in a Windows Active Directory domain. When a user logs into their domain-joined workstation, Kerberos obtains a Ticket-Granting Ticket (TGT) from the Key Distribution Center (KDC). The firewall can then use Kerberos authentication to verify the user's identity without requiring any browser-based captive portal, as the TGT or service ticket is presented automatically by the client.

Answer

LDAP

Answer

NTLM

Answer

SAML

Question 6

An organization has deployed GlobalProtect with certificate authentication. Users on macOS report that after updating their client, they cannot connect and see error 'Certificate validation failed: The certificate hash does not match.' What is the most likely cause?

Accepted Answer

The certificate pinning configuration on the gateway has a hash mismatch. The error 'Certificate validation failed: The certificate hash does not match' specifically indicates a certificate pinning mismatch. GlobalProtect certificate pinning allows the gateway to enforce that the client's certificate matches a specific hash (SHA-256 fingerprint). When the client updates, its certificate may change (e.g., due to a new key pair or renewal), causing the hash stored in the gateway's pinning configuration to no longer match, resulting in this exact error.

Answer

The root CA certificate is not trusted on the client

Answer

The CRL is not reachable

Answer

The GlobalProtect gateway certificate is expired

Question 7

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

Accepted Answer

The 'allow-list' is restricting authentication to only user1 and user2. The authentication profile includes an 'allow-list' that explicitly restricts authentication to only 'user1' and 'user2'. When a user from the 'EXAMPLE' domain attempts to authenticate, the firewall checks the allow-list first; since the user is not in that list, the authentication fails with the 'user not found' error, even if the user exists in the domain.

Answer

The Kerberos server profile 'KDC-Profile' is misconfigured

Answer

The expiration time of 60 minutes is too short

Answer

The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

Question 8

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Accepted Answer

Kerberos. Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Answer

LDAP

Answer

Local Database

Answer

RADIUS

Question 9

Which THREE factors should be considered when designing an authentication policy for a multi-zone environment with varied security requirements? (Choose THREE.)

Accepted Answer

Source zone. A is correct because source zone is a critical factor in authentication policy design, as it determines which traffic entering from specific zones (e.g., Untrust, DMZ) must be authenticated. In a multi-zone environment, different zones have varying trust levels, so authentication policies must be scoped to source zones to enforce access controls appropriately. Without source zone consideration, traffic from low-trust zones could bypass authentication, violating security requirements.

Answer

User-ID

Answer

Application ID

Question 10

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

Accepted Answer

Increase the SAML authentication timeout to 120 seconds. Increasing the SAML authentication timeout to 120 seconds accommodates delays in Azure AD response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Answer

Implement a secondary IdP as a fallback

Answer

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Answer

Switch to certificate-based authentication instead of SAML

Question 11

You are a network security engineer for a multinational corporation with users in different regions. The company uses GlobalProtect for remote access and requires multi-factor authentication (MFA) using a mobile app for all users. Recently, users in the Asia-Pacific region have reported intermittent failures when authenticating via GlobalProtect. The symptoms include: after entering credentials on the GlobalProtect portal, the authentication challenge from the MFA provider times out after 30 seconds, and the user is disconnected. Users in other regions do not experience this issue. The GlobalProtect gateways and portals are configured with Authentication Profile that uses an LDAP server for primary authentication and an MFA vendor as authentication sequence. The MFA provider sends push notifications to users' mobile devices. The firewall logs show no errors related to LDAP or MFA, but the GlobalProtect logs indicate authentication timeouts. The firewall is located in the central data center, and the MFA provider's servers are in the United States. What should you do to resolve this issue?

Accepted Answer

Increase the authentication timeout in the GlobalProtect portal and gateway configuration from 30 seconds to 60 seconds.. The authentication timeout in the GlobalProtect portal and gateway configuration defaults to 30 seconds, which is insufficient when high latency exists between the firewall (central data center) and the MFA provider's servers (United States). Users in the Asia-Pacific region experience additional network latency, causing the MFA push notification challenge to exceed the 30-second timeout. Increasing the timeout to 60 seconds accommodates this latency without altering the authentication method or requiring additional infrastructure.

Answer

Change the authentication sequence to use a shorter MFA method like SMS instead of push notifications.

Answer

Disable MFA for the Asia-Pacific region users temporarily until the MFA provider improves their latency.

Answer

Deploy a secondary MFA server instance in the Asia-Pacific region to reduce latency.

Question 12

An organization wants to enforce multi-factor authentication (MFA) for administrative access to the Palo Alto Networks firewall. Which TWO authentication methods are supported for local administrator accounts?

Accepted Answer

One-time password (OTP) via RADIUS. Palo Alto Networks firewalls support one-time password (OTP) authentication for local administrator accounts via RADIUS, where the RADIUS server generates and validates the OTP. Option D is correct because time-based one-time password (TOTP) is natively supported for local administrator MFA, using RFC 6238 to generate time-synchronized codes that the firewall validates directly without an external server.

Answer

LDAP authentication

Answer

SAML IdP authentication

Answer

Client certificate authentication

Question 13

Refer to the exhibit. A firewall administrator created a local user group named 'Engineering' and added two users. However, when applying a security policy that uses this group as the source user, only one user (asmith) is matched correctly. What is the most likely cause of this issue?

Accepted Answer

The group type is set to 'local' but the users are sourced from LDAP; change the group type to 'ldap'.. When a local user group is created on the firewall, the group type must match the source of its members. If the group type is set to 'local', the firewall expects the users to be defined locally on the firewall itself. However, if the users are actually sourced from an external LDAP directory, the group type must be changed to 'ldap' so that the firewall queries the LDAP server for group membership. The mismatch causes the firewall to fail to resolve the LDAP users as members of the local group, resulting in only locally defined users (like asmith) being matched correctly.

Answer

The group should be configured as 'local' and the users should be added manually via CLI.

Answer

The user-id agent timeout is too short; increase the timeout value.

Answer

The group must be imported from LDAP as a dynamic group.

Question 14

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

Accepted Answer

The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.. The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Answer

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Answer

The authentication sequence should be reversed to 'LDAP, PingID'.

Answer

The PingID server certificate is not trusted; import the CA certificate.

Question 15

Arrange the steps to deploy a new Panorama template to a managed firewall.

Accepted Answer

Create template, then add configuration objects, then assign template to device group, then commit template. The correct sequence for deploying a new Panorama template to a managed firewall is: first, create the template; second, add configuration objects such as interfaces and zones; third, assign the template to the relevant device group; and finally, commit the template to push the configuration to the managed firewalls. This order ensures that the template exists, contains the desired settings, is linked to the correct devices, and is then applied.

Answer

Add configuration objects, then create template, then assign template to device group, then commit template

Answer

Create template, then assign template to device group, then add configuration objects, then commit template

Answer

Create template, then add configuration objects, then commit template, then assign template to device group