PCNSE Practice Question: Securing Users and Applications with Authentication
A cloud-based application is accessed via URL filtering and uses SAML authentication. After a user changes their password in the identity provider (Okta), they are unable to authenticate to the application. The firewall is configured with an authentication policy that uses SAML. Other users who have not changed passwords can authenticate successfully. What is the most likely issue?
⚠ Common exam trap
The trap here is that candidates often focus on SAML token expiration or certificate issues, overlooking the fact that User-ID mapping caches authentication state independently of the SAML assertion lifecycle, causing a mismatch after credential changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The User-ID mapping on the firewall is outdated and still contains the user's old credentials.
When a user changes their password in Okta, the SAML assertion generated for authentication includes a new session tied to the updated credentials. However, the firewall's User-ID mapping may still cache the user's previous authentication state (including old session tokens or credentials). This stale mapping causes the firewall to reject the new SAML assertion because it does not match the cached user identity, preventing successful authentication. Other users without password changes have consistent mappings, so they authenticate normally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The User-ID mapping on the firewall is outdated and still contains the user's old credentials.
Why this is correct
The firewall might have cached the user's authentication state; clearing the user mapping or re-authenticating can resolve the issue.
- ✗
The SAML token for the user has expired.
Why it's wrong here
Token expiry would affect all users periodically, not just after a password change.
- ✗
The firewall's SAML certificate is invalid.
Why it's wrong here
A certificate issue would affect all SAML authentications, not just a single user.
- ✗
The application does not support password changes.
Why it's wrong here
This is an application-side issue, not a firewall configuration issue.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.