PCNSE Practice Question: Securing Users and Applications with Authentication
A company wants to authenticate users who are accessing internal applications from the internet through a firewall. The users should be prompted once per session. Which authentication solution best meets this requirement?
⚠ Common exam trap
Many candidates confuse 'session cookie' (Option C) with single sign-on, but Captive Portal cookies only cover the firewall's own session tracking and do not provide federated authentication across multiple applications, whereas SAML SSO does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML authentication with single sign-on.
SAML authentication with single sign-on (SSO) allows users to authenticate once per session via an external identity provider (IdP). The firewall validates the SAML assertion and maintains the session, so users are not prompted again until the session expires or is terminated. This meets the requirement of a single prompt per session without re-authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SAML authentication with single sign-on.
Why this is correct
SAML SSO allows users to authenticate once and access multiple applications without re-prompting for credentials.
- ✗
LDAP authentication with a timeout.
Why it's wrong here
LDAP authentication prompts for every new connection unless caching is used, which is not session-wide.
- ✗
Captive Portal with session cookie.
Why it's wrong here
Captive Portal typically prompts each time the cookie expires or for each new browser session, not per user session.
- ✗
RADIUS authentication with one-time passwords.
Why it's wrong here
One-time passwords provide strong security but require entering a new password each time, not a single sign-on experience.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.