PCNSE Securing Users and Applications with Authentication Practice Test 3 — 15 Questions

Question 1

A security architect needs to enforce authentication for all application-based policies using an external authentication source with MFA. Which combination of features best achieves this?

Accepted Answer

SAML authentication with an identity provider that supports MFA. B is correct because SAML authentication with an identity provider (IdP) that supports MFA allows the firewall to offload authentication to an external IdP, which can enforce multi-factor authentication (MFA) before granting access. This meets the requirement for application-based policies to use an external authentication source with MFA, as SAML provides a standards-based (SAML 2.0) mechanism for the firewall to trust the IdP's authentication assertions, including MFA status.

Answer

Local user database with password policies

Answer

Kerberos authentication with Active Directory

Answer

RADIUS authentication with one-time passwords via token

Question 2

An administrator wants to enforce authentication for SSL decrypted traffic so that only authenticated users can access decrypted content. Which firewall feature should be configured?

Accepted Answer

Authentication Policy. Authentication Policy is the correct feature because it allows the firewall to enforce user authentication specifically for SSL decrypted traffic. By configuring an Authentication Policy, the firewall can require users to authenticate before accessing decrypted content, ensuring that only authenticated users can proceed. This is distinct from SSL decryption profiles, which handle the decryption itself but not user access control.

Answer

SSL Inbound Inspection

Answer

User-ID agent

Answer

SSL Forward Proxy

Question 3

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

Accepted Answer

The authentication sequence settings in the Captive Portal configuration. When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail. Checking this first isolates the issue efficiently before investigating other components.

Answer

The certificate used for the Captive Portal page

Answer

The session timeout for authenticated users

Answer

The User-ID agent mapping

Question 4

An organization needs to enforce authentication for application-based policies. Users are in multiple AD groups. Which authentication enforcement method best scales and minimizes administrative overhead?

Accepted Answer

Authentication Policy with user group mapping. Authentication Policy with user group mapping (Option E) is the correct answer because it allows the firewall to enforce authentication based on user group membership without requiring per-user credentials at the firewall. By integrating with Active Directory via LDAP or Kerberos, the firewall can map users to groups and apply authentication policies that scale across thousands of users, minimizing administrative overhead as group changes are automatically reflected.

Answer

Single Sign-On with Kerberos

Answer

Captive Portal with RADIUS

Answer

SSL Decryption with User-ID

Answer

GlobalProtect with client certificate

Question 5

To reduce the number of authentication prompts for users accessing multiple applications through the firewall, which configuration is recommended?

Accepted Answer

Enable session cookies in the authentication policy. Enabling session cookies in the authentication policy allows the firewall to store a session cookie on the user's browser after the first successful authentication. This cookie is then presented for subsequent requests to different applications, eliminating repeated authentication prompts. The firewall validates the cookie against the existing user session, providing a seamless single sign-on (SSO) experience without requiring re-authentication for each application.

Answer

Increase the authentication timeout value

Answer

Use certificate-based authentication

Answer

Disable authentication for commonly used applications

Question 6

An organization uses Microsoft Active Directory for User-ID mapping. Some users are not being mapped because their IP addresses change frequently due to DHCP. Which approach should be implemented to ensure these users are identified?

Accepted Answer

Configure an Authentication Policy to enforce user authentication for their traffic. An Authentication Policy enforces user authentication for traffic, which triggers the firewall to learn the user-to-IP mapping in real time via authentication logs. This approach works regardless of DHCP changes, as each new IP address is immediately associated with the authenticated user. It is the most reliable method for environments with dynamic IP assignments.

Answer

Increase the IP-to-user mapping timeout

Answer

Use GlobalProtect with pre-logon token

Answer

Deploy a User-ID agent with WMI probing

Question 7

A company needs to authenticate remote users accessing internal web applications via GlobalProtect portal and wants to use SAML with Azure AD for MFA. Which component must be configured on the firewall?

Accepted Answer

Authentication profile referencing the SAML IdP profile. SAML authentication for GlobalProtect requires an authentication profile that references a SAML identity provider (IdP) profile. The firewall uses this profile to redirect users to Azure AD for SAML-based MFA, then validates the SAML assertion returned. Without this profile, the firewall cannot initiate or complete the SAML exchange.

Answer

LDAP server profile for user lookup

Answer

Server certificate for the portal

Answer

SSL decryption rule

Question 8

A security admin receives reports that some users are bypassing authentication by manually setting a different IP address. Which feature can enforce that only users who have authenticated through the firewall can access resources?

Accepted Answer

Authentication Policy requiring authentication for all traffic. Authentication Policy enforces authentication for all traffic, ensuring that only authenticated users can access resources regardless of their IP address. This prevents bypassing by manually setting a different IP. Option B (GlobalProtect client certificate authentication) does not prevent IP spoofing as certificates are tied to devices, not IPs. Option C (Security policy using source-user attribute) relies on User-ID mapping, which can be spoofed if the IP is changed before mapping. Option D (Captive Portal with cookie-based authentication) can be bypassed if the user does not go through the portal or if cookies are manipulated.

Answer

GlobalProtect client certificate authentication

Answer

Security policy using source-user attribute

Answer

Captive Portal with cookie-based authentication

Question 9

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Accepted Answer

Application type. Authentication enforcement in Palo Alto Networks is configured via Authentication Policies, which support match criteria such as source user, source IP, destination IP, application, service/port, and schedule (time of day). While many factors are possible, the most important considerations when designing an authentication enforcement strategy are the type of application being accessed (to determine if authentication is required) and the user group membership (to apply different authentication requirements to different user groups). Time of day and source IP are secondary factors that can be used for fine-tuning but are not primary design factors.

Answer

Time of day

Answer

Source IP address

Answer

Destination port

Question 10

Which THREE components are part of the GlobalProtect infrastructure? (Choose three.)

Accepted Answer

GlobalProtect Gateway. The GlobalProtect infrastructure consists of three core components: the GlobalProtect Portal, GlobalProtect Gateway, and GlobalProtect Client. The Portal manages client configurations and authentication, the Gateway enforces security policies and terminates VPN tunnels, and the Client is the endpoint software that connects to the Gateway. These three components work together to provide secure remote access.

Answer

Firewall management interface

Answer

Authentication server

Question 11

Which TWO are prerequisites for using Authentication Policy? (Choose two.)

Accepted Answer

User-ID is configured. User-ID must be configured because Authentication Policy relies on user identity information to enforce access controls based on who the user is, not just IP addresses. Without User-ID, the firewall cannot map users to traffic, making authentication policies ineffective. This prerequisite ensures the firewall can identify users via agents, captive portal, or other methods.

Answer

The firewall is in transparent mode

Answer

SSL decryption is enabled

Answer

A security policy rule exists with user attributes

Question 12

Refer to the exhibit. A user is trying to authenticate via SAML and receives this error. What is the most likely cause?

Accepted Answer

The firewall's SP entity ID does not match the audience configured in the IdP.. The error typically indicates a SAML assertion mismatch. The firewall (SP) validates that the `Audience` element in the SAML assertion matches its own SP entity ID. If they differ, the firewall rejects the assertion, causing this authentication failure.

Answer

The IdP certificate has expired.

Answer

The user's account is locked.

Answer

The SAML request timeout is set too short.

Question 13

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

Accepted Answer

The user is prompted to authenticate via the configured authentication profile.. When a user with an unknown identity (source-user unknown) attempts to access resources in 192.168.1.0/24 and the policy rule action is 'allow-authentication', the firewall prompts the user to authenticate via the configured authentication profile. Option A is incorrect because the action is not 'deny', so traffic is not blocked solely due to unknown source-user. Option B is incorrect because the traffic is not allowed without authentication; the 'allow-authentication' action requires successful authentication. Option D is incorrect because the action is specifically 'allow-authentication' which triggers an authentication prompt using the configured method (which may be captive portal, but the term 'redirect to captive portal' is less precise than 'prompted to authenticate').

Answer

The traffic is blocked because the source-user is 'unknown'.

Answer

The traffic is allowed without authentication because the source-user is 'unknown'.

Answer

The user is redirected to the captive portal.

Question 14

Refer to the exhibit. Which configuration is required in the authentication profile 'SAML-Auth'?

Accepted Answer

SAML identity provider profile. The exhibit shows a SAML-based authentication flow where the firewall redirects the user to an external identity provider (IdP) for authentication. The authentication profile 'SAML-Auth' must reference a SAML identity provider profile to define the IdP metadata, entity ID, SSO URL, and certificate binding. Without this profile, the firewall cannot initiate or validate SAML assertions, making option A the only correct choice.

Answer

LDAP server profile

Answer

RADIUS server

Answer

Kerberos realm

Question 15

A company is migrating to cloud-based SaaS applications and wants to enforce SAML-based authentication with single logout. They have a Palo Alto firewall running the latest PAN-OS. What is the recommended configuration to enable SAML authentication for these applications?

Accepted Answer

Configure a SAML identity provider profile and create an authentication policy that enforces SAML authentication for the applications.. To enforce SAML-based authentication with single logout for cloud-based SaaS applications on a Palo Alto firewall, you must configure a SAML identity provider (IdP) profile and then create an authentication policy that matches the traffic to those applications and enforces SAML authentication. The authentication policy is the mechanism that triggers the SAML flow, including single logout, for specific traffic, rather than assigning a profile directly to an application or relying on GlobalProtect or User-ID.

Answer

Create an authentication profile with SAML identity provider and assign it to the application.

Answer

Configure GlobalProtect with SAML authentication to access the SaaS applications.

Answer

Use the User-ID agent to synchronize SAML sessions between the identity provider and the firewall.