PCNSE Practice Question: Securing Users and Applications with Authentication
A company wants to authenticate users who are accessing internal applications from the internet through a firewall. The users should be prompted once per session. Which authentication solution best meets this requirement?
⚠ Common exam trap
Many candidates confuse 'session cookie' (Option C) with single sign-on, but Captive Portal cookies only cover the firewall's own session tracking and do not provide federated authentication across multiple applications, whereas SAML SSO does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML authentication with single sign-on.
SAML authentication with single sign-on (SSO) allows users to authenticate once per session via an external identity provider (IdP). The firewall validates the SAML assertion and maintains the session, so users are not prompted again until the session expires or is terminated. This meets the requirement of a single prompt per session without re-authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SAML authentication with single sign-on.
Why this is correct
SAML authentication with single sign-on satisfies the once-per-session constraint by issuing a signed assertion after the initial Microsoft Entra ID login, which the firewall validates for subsequent application requests without re-prompting. This differs from per-request authentication methods such as captive portal or client certificate checks that re-authenticate each connection.
- ✗
LDAP authentication with a timeout.
Why it's wrong here
LDAP authentication with a timeout re-queries credentials after the timeout expires, prompting the user again mid-session rather than once. It is tempting because LDAP integrates directory credentials with the firewall, and would be correct when group-based policy must be refreshed periodically from the directory.
- ✗
Captive Portal with session cookie.
Why it's wrong here
Captive Portal with a session cookie authenticates the user's web browser only, so non-web internal applications and other protocols are not covered. It is tempting because it prompts users once per session, and it would be correct if access were limited to HTTP and HTTPS traffic.
- ✗
RADIUS authentication with one-time passwords.
Why it's wrong here
RADIUS with one-time passwords prompts for a fresh code on every authentication transaction, so a user re-authenticating mid-session is challenged again rather than once per session. It is tempting because OTPs deliver strong authentication, and would be correct where per-transaction challenge strength outweighs session convenience.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.