PCNSE Practice Question: Securing Users and Applications with Authentication
A company uses GlobalProtect with SAML authentication. Users report being redirected to the IdP login page repeatedly even after successfully authenticating. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume the issue is with the IdP (session timeout or certificate) because the symptom involves the IdP login page, but the root cause is actually the GlobalProtect gateway's SAML cookie expiration timeout being too short, which is a gateway-side setting, not an IdP-side setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.
When SAML authentication succeeds but the user is repeatedly redirected to the IdP login page, the most likely cause is that the GlobalProtect gateway's SAML cookie expiration timeout is set too short. This timeout controls how long the gateway retains the SAML authentication assertion; once it expires, the gateway treats the session as unauthenticated and forces a new SAML authentication flow, even though the IdP session may still be valid. The symptom of repeated redirects after successful login points to the gateway-side timeout, not the IdP-side timeout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The authentication policy is misconfigured.
Why it's wrong here
An authentication policy controls enforcement, not session cookie timeout.
- ✓
The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.
Why this is correct
The gateway's SAML cookie timeout determines how long the authenticated session persists; if too short, users are redirected to the IdP frequently.
- ✗
The IdP session timeout is set too short.
Why it's wrong here
While a short IdP timeout could cause re-authentication, the symptom is usually a new SAML request after timeout, not immediate redirect after successful auth.
- ✗
The IdP certificate has expired.
Why it's wrong here
An expired IdP certificate would cause SAML response validation failures, not repeated redirects after successful auth.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.