PCNSE Practice Question: Securing Users and Applications with Authentication
A company is migrating to cloud-based SaaS applications and wants to enforce SAML-based authentication with single logout. They have a Palo Alto firewall running the latest PAN-OS. What is the recommended configuration to enable SAML authentication for these applications?
⚠ Common exam trap
Many candidates confuse authentication profiles (used for firewall management access) with authentication policies (used to enforce SAML on traffic), leading them to choose Option A instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a SAML identity provider profile and create an authentication policy that enforces SAML authentication for the applications.
To enforce SAML-based authentication with single logout for cloud-based SaaS applications on a Palo Alto firewall, you must configure a SAML identity provider (IdP) profile and then create an authentication policy that matches the traffic to those applications and enforces SAML authentication. The authentication policy is the mechanism that triggers the SAML flow, including single logout, for specific traffic, rather than assigning a profile directly to an application or relying on GlobalProtect or User-ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an authentication profile with SAML identity provider and assign it to the application.
Why it's wrong here
An authentication profile alone does not enforce authentication; it must be referenced in an authentication policy.
- ✗
Configure GlobalProtect with SAML authentication to access the SaaS applications.
Why it's wrong here
GlobalProtect is used for remote access VPN, not for direct authentication to SaaS applications.
- ✗
Use the User-ID agent to synchronize SAML sessions between the identity provider and the firewall.
Why it's wrong here
User-ID agent handles user mapping, not SAML authentication. SAML sessions are managed by the identity provider.
- ✓
Configure a SAML identity provider profile and create an authentication policy that enforces SAML authentication for the applications.
Why this is correct
The authentication policy defines which applications require authentication and which authentication profile to use. SAML is supported for web applications.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.