PCNSE Practice Question: Securing Users and Applications with Authentication
A security architect is designing authentication for a hybrid workforce with both on-premises and remote users. Which three best practices should be implemented? (Choose three.)
⚠ Common exam trap
A common misconception is that captive portal should only be used for on-premises users, but in Palo Alto Networks environments, it should be applied consistently across all segments, including remote users connecting via GlobalProtect or other VPN clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SAML SSO for cloud applications.
SAML SSO enables centralized identity federation for cloud applications, allowing both on-premises and remote users to authenticate via a single identity provider (IdP) without exposing on-premises credentials to the cloud. This reduces password fatigue and improves security by leveraging token-based authentication (SAML 2.0 assertions) rather than shared secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use SAML SSO for cloud applications.
Why this is correct
SAML SSO provides seamless authentication for cloud applications.
- ✓
Implement user-ID via domain controller probing.
Why this is correct
Domain controller probing is a standard method to map IP addresses to usernames on-premises.
- ✗
Use the same authentication profile for all traffic.
Why it's wrong here
Different traffic may require different authentication methods (e.g., cloud apps vs. internal).
- ✓
Configure multi-factor authentication for VPN access.
Why this is correct
MFA adds an extra layer of security for remote access.
- ✗
Deploy captive portal only for on-premises users.
Why it's wrong here
Captive portal can also be used for remote users connecting through VPN.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.