PCNSE Practice Question: Securing Users and Applications with Authentication
A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?
⚠ Common exam trap
Many candidates think reducing the timeout improves performance, but in reality, it increases failures when the IdP is slow, while increasing the timeout is the correct remedy for IdP-side latency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the SAML authentication timeout to 120 seconds
Increasing the SAML authentication timeout to 120 seconds accommodates delays in Azure AD response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a secondary IdP as a fallback
Why it's wrong here
Adding another IdP does not directly address timeout issue with Azure AD.
- ✗
Reduce the SAML authentication timeout to 30 seconds to force faster responses
Why it's wrong here
Reducing timeout would cause more failures during peak times.
- ✗
Switch to certificate-based authentication instead of SAML
Why it's wrong here
Certificate authentication avoids SAML but changes the architecture.
- ✓
Increase the SAML authentication timeout to 120 seconds
Why this is correct
Longer timeout accommodates IdP response delays during peak load.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.