PCNSA Device Management and Services Practice Question
A security admin wants to allow network engineers to log in to the firewall using their existing Active Directory credentials while maintaining a local admin account for emergency access. What should be configured?
⚠ Common exam trap
Test-takers frequently assume Kerberos or LDAP is the only way to integrate with Active Directory, or they mistakenly think that disabling local authentication is acceptable, overlooking the critical requirement for emergency access when the external authentication server is unavailable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable local authentication and configure RADIUS as the primary authentication method with local fallback.
It allows the firewall to use RADIUS as the primary authentication method, enabling network engineers to authenticate with their existing Active Directory credentials, while maintaining a local admin account for emergency access when the RADIUS server is unreachable. This configuration ensures that local authentication is available as a fallback, meeting the requirement for both centralized AD-based login and a local emergency account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create local accounts for all engineers and sync with AD manually.
Why it's wrong here
Incorrect: Manual sync is impractical and does not leverage AD.
- ✗
Use Kerberos authentication only.
Why it's wrong here
Incorrect: Kerberos requires a KDC and no fallback is configured.
- ✗
Configure only RADIUS authentication and disable local authentication.
Why it's wrong here
Incorrect: If RADIUS fails, no access possible; local account is needed for emergency.
- ✓
Enable local authentication and configure RADIUS as the primary authentication method with local fallback.
Why this is correct
Correct: This allows AD authentication while local admin account remains available for fallback.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.