PCNSE Securing Users and Applications with Authentication Practice Test 2 — 15 Questions

Question 1

A company has configured multi-factor authentication (MFA) via an authentication sequence using LDAP and RADIUS. Users authenticate successfully with LDAP but the MFA prompt from RADIUS does not appear. What is the most likely cause?

Accepted Answer

The authentication sequence must be configured to 'require all' or 'continue on success' to enforce each factor.. The authentication sequence processes factors in order. If 'continue on failure' is set, the sequence stops on the first successful factor, skipping subsequent ones. Option C correctly identifies that the sequence should be set to 'continue on success' or 'require all' to enforce all factors.

Answer

The RADIUS server profile has the wrong shared secret.

Answer

The authentication policy only covers HTTP applications.

Answer

The authentication sequence is set to 'continue on failure' and the LDAP authentication succeeds.

Question 2

A security administrator notices that users are able to bypass authentication by accessing resources using IP addresses instead of FQDNs, even though authentication policies are configured. How can this be prevented?

Accepted Answer

Configure an authentication policy with source user 'unknown' to enforce authentication for all unmapped IP addresses.. Authentication policies match based on source zone, destination zone, and application. Using IP addresses does not bypass authentication if the application is correctly identified. However, if the destination IP is not covered by the authentication policy, users may slip through. Option D is correct: create a rule to enforce authentication for unmapped users.

Answer

Create a decryption policy to decrypt all traffic.

Answer

Use identity-based routing to enforce authentication.

Answer

Enable user-ID on the ingress interface and configure authentication policy for IP addresses.

Question 3

A company wants to authenticate users who are accessing internal applications from the internet through a firewall. The users should be prompted once per session. Which authentication solution best meets this requirement?

Accepted Answer

SAML authentication with single sign-on.. SAML with single sign-on provides a seamless experience where users authenticate once and are not prompted again for subsequent applications within the session. Option A is correct.

Answer

LDAP authentication with a timeout.

Answer

Captive Portal with session cookie.

Answer

RADIUS authentication with one-time passwords.

Question 4

An administrator has configured an authentication profile with LDAP and sets the authentication sequence to 'continue on failure'. A user enters an incorrect password first, then correct. Will the user be authenticated?

Accepted Answer

No, because the sequence stops on success, but the first attempt failed.. With 'continue on failure', if the first factor fails, the sequence proceeds to the next factor. When the second factor succeeds, authentication is granted. Option D is correct.

Answer

Yes, because the sequence continues on failure and the second attempt succeeds.

Answer

Yes, but only if the LDAP server is configured for multiple attempts.

Answer

No, because the first failure blocks authentication.

Question 5

Which of the following is required for SAML-based single sign-on to work with a Palo Alto Networks firewall acting as the service provider?

Accepted Answer

The identity provider's metadata must be imported into the firewall.. The firewall must import the identity provider's metadata to establish trust and endpoints for SAML communication. Option C is correct.

Answer

A certificate from a public CA for the SAML identity provider.

Answer

The firewall must be configured as a SAML identity provider.

Answer

User-ID must be configured to poll the SAML identity provider.

Question 6

A network engineer is troubleshooting an authentication issue where users in a specific group are not being prompted for credentials, even though the authentication policy matches their traffic. The firewall logs show that the traffic is allowed by the security policy. What is the most likely cause?

Accepted Answer

The authentication policy is placed after the security rule that allows the traffic.. Authentication policies are evaluated before security rules. If the authentication policy is placed after the security rule that allows the traffic, the authentication rule is never reached. Option B is correct.

Answer

The users are in a group that is excluded from authentication in the authentication profile.

Answer

The captive portal is not enabled on the interface.

Answer

The user-ID agent is not configured to include that group.

Question 7

An organization uses captive portal authentication. Users report that after closing the browser, they are still authenticated and can access resources without re-authenticating. How can the administrator enforce re-authentication after browser closure?

Accepted Answer

Clear the 'allow session cookie' option in the captive portal profile.. Captive portal uses a session cookie to maintain authentication. Clearing the 'allow session cookie' option forces the user to authenticate for each new browser session. Option B is correct.

Answer

Configure the authentication enforcement to require authentication for each session.

Answer

Set the session timeout to 0 in the captive portal profile.

Answer

Disable the 'session cookie' setting in the captive portal profile and change the authentication profile to use RADIUS.

Question 8

When configuring an authentication policy, which match criteria is required to trigger authentication?

Accepted Answer

Source zone must be specified.. Authentication policy requires source zone and application to be specified; source user can be 'any'. Option C is correct.

Answer

Application must be 'web-browsing'.

Answer

Destination address must be the server IP.

Answer

Source user must be set to 'any'.

Question 9

An administrator is configuring authentication for a captive portal. Which two configuration steps are necessary? (Choose two.)

Accepted Answer

Create an authentication policy matching the captive portal traffic.. Correct steps: A (create authentication policy to redirect to captive portal) and C (configure captive portal profile with authentication server). Options B and D are not strictly necessary for captive portal to function.

Answer

Enable user-ID on the interface where users connect.

Answer

Configure a security policy to allow the captive portal traffic before authentication.

Answer

Import the captive portal certificate.

Question 10

A security architect is designing authentication for a hybrid workforce with both on-premises and remote users. Which three best practices should be implemented? (Choose three.)

Accepted Answer

Use SAML SSO for cloud applications.. Best practices include SAML SSO for cloud apps (A), MFA for VPN (C), and user-ID via domain controller probing (E). Options B and D are not recommended.

Answer

Use the same authentication profile for all traffic.

Answer

Deploy captive portal only for on-premises users.

Question 11

When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)

Accepted Answer

less mp-log authd.log. 'show authentication rule matching traffic from the user's IP' (B) checks if the authentication rule triggers for the traffic, and 'less mp-log authd.log' (C) shows detailed authentication server interaction. Options A, D, E are less direct.

Answer

show running security-policy

Answer

show user user-id count

Answer

show system resources

Question 12

Refer to the exhibit. A network administrator is troubleshooting why users are not being prompted for authentication when accessing HTTPS sites. The authentication rule and security policy are shown. What is the most likely cause?

Accepted Answer

The authentication rule is placed after the security policy that allows the traffic.. The authentication rule and security rule both match the same traffic. Since the security rule is evaluated before authentication rules (unless the authentication rule is in a pre-rulebase), the traffic is allowed without authentication. Option C is correct.

Answer

The application 'ssl' is not correctly identified.

Answer

The authentication rule is placed before the security policy in the rulebase.

Answer

The authentication profile 'AuthProfile' is not configured.

Question 13

Refer to the exhibit. The administrator committed this configuration but users cannot authenticate via SAML. What is the problem?

Accepted Answer

The authentication profile has two methods configured, causing a conflict.. The authentication profile has two 'method' commands; the second one overwrites the first, so the profile ends up using LDAP instead of SAML. Option B is correct.

Answer

The firewall is not configured as a service provider.

Answer

The SAML identity provider certificate is missing.

Answer

The SAML logout URL is incorrect.

Question 14

Refer to the exhibit. A user at IP 10.10.1.11 is unable to access internal resources that require authentication. The firewall logs show 'no user mapping' for traffic from this IP. Which step should the administrator take first?

Accepted Answer

Verify that the User-ID agent has network access to the client at 10.10.1.11.. The source is unknown, indicating no user mapping for that IP. The first step is to verify that the User-ID agent can reach the client to map the user. Option A is correct.

Answer

Configure an authentication policy to trigger captive portal for that IP.

Answer

Check the Kerberos keytab file.

Answer

Manually create a static mapping for IP 10.10.1.11.

Question 15

A company uses GlobalProtect with SAML authentication. Users report being redirected to the IdP login page repeatedly even after successfully authenticating. What is the most likely cause?

Accepted Answer

The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.. Option D is correct because the SAML cookie expiration timeout on the gateway configuration determines how long the authenticated session is valid. If set too short, users will be prompted to re-authenticate frequently. Option A is incorrect because the IdP certificate is valid for encryption, not session duration. Option B is incorrect because the IdP timeout is managed by the IdP, but the firewall's cookie timeout is the culprit. Option C is incorrect because the authentication policy does not control session cookie timeouts.

Answer

The authentication policy is misconfigured.

Answer

The IdP session timeout is set too short.

Answer

The IdP certificate has expired.