PCNSE Securing Users and Applications with Authentication Practice Test 3 — 15 Questions

Question 1

A security architect needs to enforce authentication for all application-based policies using an external authentication source with MFA. Which combination of features best achieves this?

Accepted Answer

SAML authentication with an identity provider that supports MFA. Option B is correct because SAML with an IdP that supports MFA allows the firewall to delegate authentication to the IdP, which can enforce MFA. Option A is incorrect because Kerberos does not natively support MFA. Option C is incorrect because local user database does not support external MFA. Option D is incorrect because RADIUS with one-time passwords may require additional infrastructure and is less flexible than SAML for MFA.

Answer

Local user database with password policies

Answer

Kerberos authentication with Active Directory

Answer

RADIUS authentication with one-time passwords via token

Question 2

An administrator wants to enforce authentication for SSL decrypted traffic so that only authenticated users can access decrypted content. Which firewall feature should be configured?

Accepted Answer

Authentication Policy. Option C is correct because Authentication Policy can be used to require authentication before traffic is allowed, including decrypted traffic. Option A is incorrect because SSL Forward Proxy is used for decryption, not authentication enforcement. Option B is incorrect because SSL Inbound Inspection is for inbound traffic. Option D is incorrect because User-ID agent maps users, but does not enforce authentication.

Answer

SSL Inbound Inspection

Answer

User-ID agent

Answer

SSL Forward Proxy

Question 3

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

Accepted Answer

The authentication sequence settings in the Captive Portal configuration. Option A is correct because the authentication sequence determines the order and fallback of authentication servers; if misconfigured, requests may time out without proper fallback. Option B is incorrect because the certificate is for SSL, not timeout. Option C is incorrect because the user-ID agent is not directly involved in Captive Portal authentication. Option D is incorrect because the session timeout affects logged-in sessions, not the authentication process.

Answer

The certificate used for the Captive Portal page

Answer

The session timeout for authenticated users

Answer

The User-ID agent mapping

Question 4

An organization needs to enforce authentication for application-based policies. Users are in multiple AD groups. Which authentication enforcement method best scales and minimizes administrative overhead?

Accepted Answer

Authentication Policy with user group mapping. Option E is correct because Authentication Policy with user group mapping allows group-based authentication enforcement without modifying security policies. Option A is incorrect because SSO with Kerberos requires Kerberos realm configuration and may not scale well. Option B is incorrect because Captive Portal with RADIUS requires per-user configuration. Option C is incorrect because GlobalProtect with client certificate requires client deployment overhead. Option D is incorrect because SSL decryption does not enforce authentication.

Answer

Single Sign-On with Kerberos

Answer

Captive Portal with RADIUS

Answer

SSL Decryption with User-ID

Answer

GlobalProtect with client certificate

Question 5

To reduce the number of authentication prompts for users accessing multiple applications through the firewall, which configuration is recommended?

Accepted Answer

Enable session cookies in the authentication policy. Option A is correct because enabling session cookies allows users to skip re-authentication for a set duration. Option B is incorrect because certificate-based authentication requires certificates on all devices. Option C is incorrect because increasing authentication timeout still requires initial authentication per session. Option D is incorrect because disabling authentication for certain apps defeats the purpose.

Answer

Increase the authentication timeout value

Answer

Use certificate-based authentication

Answer

Disable authentication for commonly used applications

Question 6

An organization uses Microsoft Active Directory for User-ID mapping. Some users are not being mapped because their IP addresses change frequently due to DHCP. Which approach should be implemented to ensure these users are identified?

Accepted Answer

Configure an Authentication Policy to enforce user authentication for their traffic. Option D is correct because configuring Authentication Policy to force explicit authentication for those users will create IP-to-user mappings when they authenticate. Option A is incorrect because increasing timeout does not solve the mapping issue. Option B is incorrect because User-ID agent with WMI may not keep up with rapid changes. Option C is incorrect because GlobalProtect with pre-logon is for machine authentication.

Answer

Increase the IP-to-user mapping timeout

Answer

Use GlobalProtect with pre-logon token

Answer

Deploy a User-ID agent with WMI probing

Question 7

A company needs to authenticate remote users accessing internal web applications via GlobalProtect portal and wants to use SAML with Azure AD for MFA. Which component must be configured on the firewall?

Accepted Answer

Authentication profile referencing the SAML IdP profile. Option C is correct because an Authentication Profile referencing the SAML IdP profile is mandatory for the portal to use SAML. Option A is incorrect because SSL decryption is not required for SAML. Option B is incorrect while a certificate is needed for the portal, it is not specific to SAML. Option D is incorrect because LDAP server profile is for LDAP, not SAML.

Answer

LDAP server profile for user lookup

Answer

Server certificate for the portal

Answer

SSL decryption rule

Question 8

A security admin receives reports that some users are bypassing authentication by manually setting a different IP address. Which feature can enforce that only users who have authenticated through the firewall can access resources?

Accepted Answer

Authentication Policy requiring authentication for all traffic. Option B is correct because Authentication Policy enforces authentication before allowing traffic, regardless of IP address. Option A is incorrect because GlobalProtect client certificates may not prevent IP spoofing. Option C is incorrect because Captive Portal requires interaction, but users may still bypass if they don't go through it. Option D is incorrect because Security Policy with user attribute relies on User-ID, which can be spoofed if not enforced.

Answer

GlobalProtect client certificate authentication

Answer

Security policy using source-user attribute

Answer

Captive Portal with cookie-based authentication

Question 9

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Accepted Answer

Application type. Options A and C are correct. User group membership allows group-based enforcement, and application type allows context-aware enforcement. Option B (time of day) is possible but not a primary factor; option D (source IP) is often used but not a primary design factor; option E (destination port) is less relevant for authentication.

Answer

Time of day

Answer

Source IP address

Answer

Destination port

Question 10

Which THREE components are part of the GlobalProtect infrastructure? (Choose three.)

Accepted Answer

GlobalProtect Gateway. Options A, B, and D are correct. The Portal distributes configuration, Gateways provide secure access, and Clients connect to them. Option C (Firewall management interface) is not part of GlobalProtect infrastructure; it's used for managing the firewall. Option E (Authentication server) is a backend component but not part of GlobalProtect infrastructure itself.

Answer

Firewall management interface

Answer

Authentication server

Question 11

Which TWO are prerequisites for using Authentication Policy? (Choose two.)

Accepted Answer

User-ID is configured. Options A and D are correct. User-ID must be configured to identify users, and an authentication profile must be defined to specify the authentication method. Option B (SSL decryption) is not required. Option C (security policy with user attribute) is not a prerequisite, though often used. Option E (transparent mode) is false.

Answer

The firewall is in transparent mode

Answer

SSL decryption is enabled

Answer

A security policy rule exists with user attributes

Question 12

Refer to the exhibit. A user is trying to authenticate via SAML and receives this error. What is the most likely cause?

Accepted Answer

The firewall's SP entity ID does not match the audience configured in the IdP.. Option B is correct because the 'Invalid audience' error indicates that the audience in the SAML response (provided by the IdP) does not match the expected SP entity ID configured on the firewall. Option A is incorrect because certificate expiry would cause a different error. Option C is incorrect because account lockout would result in an authentication failure with a different reason. Option D is incorrect because timeout would show a different error.

Answer

The IdP certificate has expired.

Answer

The user's account is locked.

Answer

The SAML request timeout is set too short.

Question 13

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

Accepted Answer

The user is prompted to authenticate via the configured authentication profile.. Option A is correct because the action 'allow-authentication' prompts the user to authenticate using the specified authentication profile. Option B is incorrect because the traffic is not allowed before authentication. Option C is incorrect because the policy does not block; it triggers authentication. Option D is incorrect because the action is not redirect; it's authentication prompt via the configured method.

Answer

The traffic is blocked because the source-user is 'unknown'.

Answer

The traffic is allowed without authentication because the source-user is 'unknown'.

Answer

The user is redirected to the captive portal.

Question 14

Refer to the exhibit. Which configuration is required in the authentication profile 'SAML-Auth'?

Accepted Answer

SAML identity provider profile. Option C is correct because a SAML authentication profile must reference a SAML identity provider profile that contains the IdP metadata. Option A is incorrect because LDAP server profile is for LDAP authentication. Option B is incorrect because Kerberos realm is for Kerberos. Option D is incorrect because RADIUS server is for RADIUS.

Answer

LDAP server profile

Answer

RADIUS server

Answer

Kerberos realm

Question 15

A company is migrating to cloud-based SaaS applications and wants to enforce SAML-based authentication with single logout. They have a Palo Alto firewall running the latest PAN-OS. What is the recommended configuration to enable SAML authentication for these applications?

Accepted Answer

Configure a SAML identity provider profile and create an authentication policy that enforces SAML authentication for the applications.. Option C is correct because SAML authentication policy on the firewall is used to enforce SAML authentication for web-based applications, and enabling the authentication policy allows the firewall to redirect users to the SAML IdP for authentication. Option A is partially correct but missing the policy component. Option B is for VPN access, not direct app authentication. Option D is not relevant as User-ID agent does not handle SAML sessions.

Answer

Create an authentication profile with SAML identity provider and assign it to the application.

Answer

Configure GlobalProtect with SAML authentication to access the SaaS applications.

Answer

Use the User-ID agent to synchronize SAML sessions between the identity provider and the firewall.