← PCNSE·Palo Alto Networks

Question 437 of 516

Securing Users and Applications with Authentication →hardMultiple ChoiceObjective-mapped

Authentication Policy Order: Why Users Aren't Prompted

This PCNSE practice question tests your understanding of securing users and applications with authentication. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A network engineer is troubleshooting an authentication issue where users in a specific group are not being prompted for credentials, even though the authentication policy matches their traffic. The firewall logs show that the traffic is allowed by the security policy. What is the most likely cause?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

A
The users are in a group that is excluded from authentication in the authentication profile.
Why wrong: Group exclusion would apply to the authentication profile, not prevent the prompt altogether.
B
The captive portal is not enabled on the interface.
Why wrong: Captive portal is part of the authentication policy action; if the policy matches, the portal is triggered regardless of interface setting.
C
The user-ID agent is not configured to include that group.
Why wrong: User-ID agent is not required for the authentication prompt; it only provides user mapping for logs and additional policy matching.
D
The authentication policy is placed after the security rule that allows the traffic.
If the security rule allowing the traffic is evaluated before the authentication rule, the traffic is allowed without authentication.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The authentication policy is placed after the security rule that allows the traffic.

When an authentication policy matches traffic but users are not prompted for credentials, the most likely cause is that the authentication policy is placed after the security rule that allows the traffic. In Palo Alto Networks firewalls, policies are evaluated in order, and if a security rule permits the traffic before the authentication policy is reached, the session is allowed without requiring authentication. The authentication policy must be placed before the relevant security rule to intercept the traffic and prompt for credentials.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The users are in a group that is excluded from authentication in the authentication profile.
Why it's wrong here
Group exclusion would apply to the authentication profile, not prevent the prompt altogether.
✗
The captive portal is not enabled on the interface.
Why it's wrong here
Captive portal is part of the authentication policy action; if the policy matches, the portal is triggered regardless of interface setting.
✗
The user-ID agent is not configured to include that group.
Why it's wrong here
User-ID agent is not required for the authentication prompt; it only provides user mapping for logs and additional policy matching.
✓
The authentication policy is placed after the security rule that allows the traffic.
Why this is correct
If the security rule allowing the traffic is evaluated before the authentication rule, the traffic is allowed without authentication.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often assume authentication policies are evaluated before security policies, but in Palo Alto Networks firewalls, security policies are evaluated first, and if traffic matches a permit rule, authentication policies are not applied.

Detailed technical explanation

How to think about this question

Palo Alto Networks firewalls process policies in a specific order: security policies are evaluated first, then authentication policies, then decryption policies, and finally QoS policies. If a security rule permits traffic before the authentication policy is reached, the firewall will not enforce authentication for that session, even if the authentication policy would otherwise match. This is a common misconfiguration where administrators place authentication policies after broad permit rules, causing authentication to be bypassed for traffic that matches those rules. The authentication policy must be placed before any security rule that would allow the traffic to ensure it is evaluated.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PCNSE practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Manage, Monitor and Operate practice questions

Practise PCNSE questions linked to Manage, Monitor and Operate.

Securing Traffic and App-ID practice questions

Practise PCNSE questions linked to Securing Traffic and App-ID.

Securing Users and Applications with Authentication practice questions

Practise PCNSE questions linked to Securing Users and Applications with Authentication.

Decryption and SSL Inspection practice questions

Practise PCNSE questions linked to Decryption and SSL Inspection.

Managing Troubleshooting and High Availability practice questions

Practise PCNSE questions linked to Managing Troubleshooting and High Availability.

Deploy and Configure Firewalls practice questions

Practise PCNSE questions linked to Deploy and Configure Firewalls.

Core Concepts and Architecture practice questions

Practise PCNSE questions linked to Core Concepts and Architecture.

Secure Access and VPN practice questions

Practise PCNSE questions linked to Secure Access and VPN.

Troubleshoot practice questions

Practise PCNSE questions linked to Troubleshoot.

PCNSE fundamentals practice questions

Practise PCNSE questions linked to PCNSE fundamentals.

PCNSE scenario practice questions

Practise PCNSE questions linked to PCNSE scenario.

PCNSE troubleshooting practice questions

Practise PCNSE questions linked to PCNSE troubleshooting.

Practice this exam

Start a free PCNSE practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PCNSE practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PCNSE question test?

Securing Users and Applications with Authentication — This question tests Securing Users and Applications with Authentication — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The authentication policy is placed after the security rule that allows the traffic. — When an authentication policy matches traffic but users are not prompted for credentials, the most likely cause is that the authentication policy is placed after the security rule that allows the traffic. In Palo Alto Networks firewalls, policies are evaluated in order, and if a security rule permits the traffic before the authentication policy is reached, the session is allowed without requiring authentication. The authentication policy must be placed before the relevant security rule to intercept the traffic and prompt for credentials.

What should I do if I get this PCNSE question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on PCNSE

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)

medium

✓ A.less mp-log authd.log
B.show running security-policy
C.show user user-id count
✓ D.show authentication rule matching traffic from the user's IP
E.show system resources

Why A: Option A is correct because the `authd.log` file contains detailed authentication daemon logs, including credential challenges, authentication successes, and failures. When users are not prompted for credentials, this log reveals whether the firewall is even attempting to authenticate the user or if the request is being bypassed due to policy misconfiguration. Option D is correct because the `show authentication rule matching traffic from the user's IP` command allows you to test which authentication policy rule applies to a specific user's traffic, helping identify if the rule is missing, misordered, or incorrectly configured to skip credential prompting.

Variation 2. Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

hard

A.The traffic is blocked because the source-user is 'unknown'.
B.The traffic is allowed without authentication because the source-user is 'unknown'.
✓ C.The user is prompted to authenticate via the configured authentication profile.
D.The user is redirected to the captive portal.

Why C: Option C is correct. When a user with an unknown identity (source-user unknown) attempts to access resources in 192.168.1.0/24 and the policy rule action is 'allow-authentication', the firewall prompts the user to authenticate via the configured authentication profile. Option A is incorrect because the action is not 'deny', so traffic is not blocked solely due to unknown source-user. Option B is incorrect because the traffic is not allowed without authentication; the 'allow-authentication' action requires successful authentication. Option D is incorrect because the action is specifically 'allow-authentication' which triggers an authentication prompt using the configured method (which may be captive portal, but the term 'redirect to captive portal' is less precise than 'prompted to authenticate').

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.