PCNSE Practice Question: Securing Users and Applications with Authentication
A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?
⚠ Common exam trap
A common mix-up: candidates assume MFA bypass is always due to firewall misconfiguration (like sequence order or certificate issues), when in reality the PingID agent's fallback behavior can silently skip MFA even when the firewall and network connectivity are correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.
The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.
Why it's wrong here
Incorrect: The authentication policy already triggers the authentication sequence; the issue is that MFA is not being enforced.
- ✗
The authentication sequence should be reversed to 'LDAP, PingID'.
Why it's wrong here
Incorrect: Reversing the sequence would attempt LDAP first, then PingID, which would still not enforce MFA if LDAP succeeds.
- ✗
The PingID server certificate is not trusted; import the CA certificate.
Why it's wrong here
Incorrect: The PingID service is reachable, so certificate trust is not the likely issue.
- ✓
The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.
Why this is correct
Correct: If PingID allows fallback, the firewall will proceed to LDAP without MFA.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.