PCNSE Practice Question: Securing Users and Applications with Authentication
A network engineer is troubleshooting an authentication issue where users in a specific group are not being prompted for credentials, even though the authentication policy matches their traffic. The firewall logs show that the traffic is allowed by the security policy. What is the most likely cause?
⚠ Common exam trap
Candidates often assume security policies are evaluated before authentication policies, but in Palo Alto Networks firewalls, authentication policies are evaluated first. A matching authentication policy enforces authentication before security policy evaluation, so placing the authentication policy after a security rule does not bypass authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The users are in a group that is excluded from authentication in the authentication profile.
When an authentication policy matches traffic but users in a specific group are not prompted for credentials, the most likely cause is that the group is excluded from authentication in the authentication profile. An authentication profile can include an allow list/exclusion list; users in an excluded group are not prompted for authentication even though the authentication policy matches. Authentication policies are evaluated before security policies, so a security policy allowing the traffic does not bypass authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The users are in a group that is excluded from authentication in the authentication profile.
Why this is correct
Group exclusion would apply to the authentication profile, not prevent the prompt altogether.
- ✗
The captive portal is not enabled on the interface.
Why it's wrong here
Captive portal is part of the authentication policy action; if the policy matches, the portal is triggered regardless of interface setting.
- ✗
The user-ID agent is not configured to include that group.
Why it's wrong here
User-ID agent is not required for the authentication prompt; it only provides user mapping for logs and additional policy matching.
- ✗
The authentication policy is placed after the security rule that allows the traffic.
Why it's wrong here
If the security rule allowing the traffic is evaluated before the authentication rule, the traffic is allowed without authentication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.