PCNSE Securing Users and Applications with Authentication Practice Test 2 — 15 Questions

Question 1

Match each security profile type to its purpose.

Accepted Answer

Antivirus: Scans for malware and viruses in files.. The correct matches are: Antivirus scans for malware, Anti-Spyware protects against spyware, Vulnerability Protection prevents exploitation. URL Filtering categorizes URLs, and File Blocking blocks file types. Options D and E swap these definitions.

Answer

URL Filtering: Blocks files based on type and direction.

Answer

File Blocking: Categorizes URLs and controls access based on categories.

Question 2

An administrator configures an authentication policy to require authentication for the 'ssl' application. After committing, the firewall does not prompt users for credentials when they access HTTPS sites. Which step is most likely missing?

Accepted Answer

The authentication policy must be placed before the security rule that allows the web-browsing traffic.. When an authentication policy is configured for the 'ssl' application, the firewall must identify the traffic as matching that rule before it reaches the security policy processing. Authentication policies are evaluated prior to security policies, but they exist in a separate rulebase. If the authentication policy rule is not correctly ordered within its own rulebase, or if it is not properly matched, the firewall will proceed to the security policy and possibly allow the traffic without authentication. One common oversight is not placing the authentication policy rule in a position where it will be evaluated before the traffic is permitted by a broad security rule, such as one allowing web-browsing. In this case, the authentication policy must be placed before the security rule that allows web-browsing traffic, meaning it must be processed first in the firewall's evaluation order.

Answer

The authentication policy is placed in the pre-rulebase but the security policy is in post-rulebase.

Answer

The 'ssl' application must have a custom signature defined.

Answer

The user-ID agent is not set to capture HTTPS traffic.

Question 3

A security administrator notices that users are able to bypass authentication by accessing resources using IP addresses instead of FQDNs, even though authentication policies are configured. How can this be prevented?

Accepted Answer

Configure an authentication policy with source user 'unknown' to enforce authentication for all unmapped IP addresses.. When users access resources by IP address rather than FQDN, the firewall cannot associate the traffic with a specific user via normal authentication policies (which rely on domain-based rules). By configuring an authentication policy with source user 'unknown', the firewall forces authentication for all unmapped IP addresses, ensuring that even IP-based access triggers user identification and policy enforcement.

Answer

Create a decryption policy to decrypt all traffic.

Answer

Use identity-based routing to enforce authentication.

Answer

Enable user-ID on the ingress interface and configure authentication policy for IP addresses.

Question 4

A company wants to authenticate users who are accessing internal applications from the internet through a firewall. The users should be prompted once per session. Which authentication solution best meets this requirement?

Accepted Answer

SAML authentication with single sign-on.. SAML authentication with single sign-on (SSO) allows users to authenticate once per session via an external identity provider (IdP). The firewall validates the SAML assertion and maintains the session, so users are not prompted again until the session expires or is terminated. This meets the requirement of a single prompt per session without re-authentication.

Answer

LDAP authentication with a timeout.

Answer

Captive Portal with session cookie.

Answer

RADIUS authentication with one-time passwords.

Question 5

An administrator has configured an authentication profile with LDAP and sets the authentication sequence to 'continue on failure'. A user enters an incorrect password first, then correct. Will the user be authenticated?

Accepted Answer

No, because the sequence stops on success, but the first attempt failed.. The authentication sequence 'continue on failure' only proceeds to the next authentication method if the current method fails (e.g., server timeout or unreachable). It does NOT retry the same LDAP server with a different password. Since the first attempt failed due to an incorrect password, the sequence stops, and the user is not authenticated. The second correct password is never attempted because the failure is treated as a final rejection, not a retry opportunity.

Answer

Yes, because the sequence continues on failure and the second attempt succeeds.

Answer

Yes, but only if the LDAP server is configured for multiple attempts.

Answer

No, because the first failure blocks authentication.

Question 6

Which of the following is required for SAML-based single sign-on to work with a Palo Alto Networks firewall acting as the service provider?

Accepted Answer

The identity provider's metadata must be imported into the firewall.. For SAML-based single sign-on (SSO) with a Palo Alto Networks firewall acting as the service provider (SP), the firewall must trust the identity provider (IdP). This trust is established by importing the IdP's SAML metadata (which includes the IdP's entity ID, single sign-on URL, and signing certificate) into the firewall. Without this metadata, the firewall cannot validate SAML assertions from the IdP, making authentication impossible.

Answer

A certificate from a public CA for the SAML identity provider.

Answer

The firewall must be configured as a SAML identity provider.

Answer

User-ID must be configured to poll the SAML identity provider.

Question 7

An organization uses captive portal authentication. Users report that after closing the browser, they are still authenticated and can access resources without re-authenticating. How can the administrator enforce re-authentication after browser closure?

Accepted Answer

Clear the 'allow session cookie' option in the captive portal profile.. Captive portal uses a session cookie to maintain authentication. Clearing the 'allow session cookie' option forces the user to authenticate for each new browser session. Option A is correct.

Answer

Configure the authentication enforcement to require authentication for each session.

Answer

Set the session timeout to 0 in the captive portal profile.

Answer

Disable the 'session cookie' setting in the captive portal profile and change the authentication profile to use RADIUS.

Question 8

When configuring an authentication policy, which match criteria is required to trigger authentication?

Accepted Answer

Source zone must be specified.. In a PAN-OS authentication policy, the source zone is a required match criterion because the firewall must know which ingress zone the traffic is coming from to apply the correct authentication profile and enforce the policy. Without a specified source zone, the policy cannot be evaluated, as zone-based forwarding is fundamental to how the firewall processes traffic. This ensures that authentication is triggered only for traffic entering through a designated zone, such as an untrust or internal zone.

Answer

Application must be 'web-browsing'.

Answer

Destination address must be the server IP.

Answer

Source user must be set to 'any'.

Question 9

An administrator is configuring authentication for a captive portal. Which two configuration steps are necessary? (Choose two.)

Accepted Answer

Create an authentication policy matching the captive portal traffic.. An authentication policy must be created to match the captive portal traffic and trigger authentication. This policy defines which traffic requires authentication and specifies the authentication profile to use. Without it, the firewall will not know to intercept the user's HTTP request and redirect them to the captive portal login page.

Answer

Enable user-ID on the interface where users connect.

Answer

Configure a security policy to allow the captive portal traffic before authentication.

Answer

Import the captive portal certificate.

Question 10

A security architect is designing authentication for a hybrid workforce with both on-premises and remote users. Which three best practices should be implemented? (Choose three.)

Accepted Answer

Use SAML SSO for cloud applications.. SAML SSO enables centralized identity federation for cloud applications, allowing both on-premises and remote users to authenticate via a single identity provider (IdP) without exposing on-premises credentials to the cloud. This reduces password fatigue and improves security by leveraging token-based authentication (SAML 2.0 assertions) rather than shared secrets.

Answer

Use the same authentication profile for all traffic.

Answer

Deploy captive portal only for on-premises users.

Question 11

When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)

Accepted Answer

less mp-log authd.log. The `authd.log` file contains detailed authentication daemon logs, including credential challenges, authentication successes, and failures. When users are not prompted for credentials, this log reveals whether the firewall is even attempting to authenticate the user or if the request is being bypassed due to policy misconfiguration. Option D is correct because the `show authentication rule matching traffic from the user's IP` command allows you to test which authentication policy rule applies to a specific user's traffic, helping identify if the rule is missing, misordered, or incorrectly configured to skip credential prompting.

Answer

show running security-policy

Answer

show user user-id count

Answer

show system resources

Question 12

Refer to the exhibit. A network administrator is troubleshooting why users are not being prompted for authentication when accessing HTTPS sites. The authentication rule and security policy are shown. What is the most likely cause?

Accepted Answer

The authentication rule is placed after the security policy that allows the traffic.. The authentication rule is evaluated after the security policy in the rulebase (unless placed in a pre-rulebase). Since the security policy allows the HTTPS traffic without requiring authentication, users are not prompted. For authentication to be enforced, the authentication rule must be placed before the security policy or in a pre-rulebase, which corresponds to option A.

Answer

The application 'ssl' is not correctly identified.

Answer

The authentication rule is placed before the security policy in the rulebase.

Answer

The authentication profile 'AuthProfile' is not configured.

Question 13

Refer to the exhibit. The administrator committed this configuration but users cannot authenticate via SAML. What is the problem?

Accepted Answer

The authentication profile has two methods configured, causing a conflict.. The authentication profile has two 'method' commands; the second one overwrites the first, so the profile ends up using LDAP instead of SAML. This causes a conflict and prevents SAML authentication. Therefore, Option A is correct.

Answer

The firewall is not configured as a service provider.

Answer

The SAML identity provider certificate is missing.

Answer

The SAML logout URL is incorrect.

Question 14

Refer to the exhibit. A user at IP 10.10.1.11 is unable to access internal resources that require authentication. The firewall logs show 'no user mapping' for traffic from this IP. Which step should the administrator take first?

Accepted Answer

Verify that the User-ID agent has network access to the client at 10.10.1.11.. The 'no user mapping' error indicates that the firewall cannot correlate the IP address (10.10.1.11) with a username. The first step is to verify that the User-ID agent can reach the client, because without network connectivity, the agent cannot collect user mappings via probing (e.g., WMI, NetBIOS, or terminal services). Option B directly addresses this root cause.

Answer

Configure an authentication policy to trigger captive portal for that IP.

Answer

Check the Kerberos keytab file.

Answer

Manually create a static mapping for IP 10.10.1.11.

Question 15

A company uses GlobalProtect with SAML authentication. Users report being redirected to the IdP login page repeatedly even after successfully authenticating. What is the most likely cause?

Accepted Answer

The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.. When SAML authentication succeeds but the user is repeatedly redirected to the IdP login page, the most likely cause is that the GlobalProtect gateway's SAML cookie expiration timeout is set too short. This timeout controls how long the gateway retains the SAML authentication assertion; once it expires, the gateway treats the session as unauthenticated and forces a new SAML authentication flow, even though the IdP session may still be valid. The symptom of repeated redirects after successful login points to the gateway-side timeout, not the IdP-side timeout.

Answer

The authentication policy is misconfigured.

Answer

The IdP session timeout is set too short.

Answer

The IdP certificate has expired.