SSE-Engineer Prisma Access Troubleshooting Practice Question
Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the SAML Identity Provider (IdP) signing certificate imported into Panorama matches the active IdP certificate.
Troubleshooting SAML authentication involves verifying clock skew, IdP metadata/certificates, and authentication profile configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the NAT policy rules.
Why it's wrong here
NAT policies do not govern SAML assertion exchanges.
- ✗
Check the URL Filtering category for the IdP login domain.
Why it's wrong here
URL filtering categorization does not impact valid SAML authentication token processing.
- ✗
Restart the physical firewall in the branch office.
Why it's wrong here
Branch hardware restarts do not affect mobile user cloud SAML authentication.
- ✓
Verify that the SAML Identity Provider (IdP) signing certificate imported into Panorama matches the active IdP certificate.
Why this is correct
Mismatched or expired IdP certificates cause signature validation failures.
- ✓
Check for clock skew between the SAML IdP and Prisma Access service nodes.
Why this is correct
Significant time differences between the IdP and Prisma Access cause SAML assertion timestamps to be rejected.
About these practice questions
This SSE-Engineer question is part of Courseiva's 203-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SSE-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSE-Engineer exam.