PCNSE Practice Question: Securing Users and Applications with Authentication
A security admin receives reports that some users are bypassing authentication by manually setting a different IP address. Which feature can enforce that only users who have authenticated through the firewall can access resources?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication Policy requiring authentication for all traffic
Authentication Policy enforces authentication for all traffic, ensuring that only authenticated users can access resources regardless of their IP address. This prevents bypassing by manually setting a different IP. Option B (GlobalProtect client certificate authentication) does not prevent IP spoofing as certificates are tied to devices, not IPs. Option C (Security policy using source-user attribute) relies on User-ID mapping, which can be spoofed if the IP is changed before mapping. Option D (Captive Portal with cookie-based authentication) can be bypassed if the user does not go through the portal or if cookies are manipulated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication Policy requiring authentication for all traffic
Why this is correct
Authentication Policy forces users to authenticate before traffic is allowed, preventing IP-based bypass.
- ✗
GlobalProtect client certificate authentication
Why it's wrong here
Certificates authenticate the device, not necessarily the user, and can still be bypassed with IP changes.
- ✗
Security policy using source-user attribute
Why it's wrong here
User-ID mapping may be stale or spoofable.
- ✗
Captive Portal with cookie-based authentication
Why it's wrong here
Cookie-based auth can be shared or bypassed by not using the portal.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.