PCNSE Practice Question: Securing Users and Applications with Authentication
After a PAN-OS upgrade from 9.1 to 10.2, users report that captive portal authentication fails consistently. The authentication profile uses LDAP and the LDAP server is reachable from the firewall. The captive portal page loads, but after entering credentials, users are redirected back to the login page. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on LDAP connectivity or certificate issues, overlooking the critical post-upgrade requirement to reapply the authentication profile to the ingress interface, which is a common PAN-OS upgrade pitfall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The captive portal authentication profile is not applied to the ingress interface after the upgrade.
After a PAN-OS upgrade, the captive portal authentication profile must be explicitly applied to the ingress interface. If it is not, the firewall will not enforce captive portal authentication on traffic entering that interface, causing the login page to load but credentials to be rejected and the user redirected back to the login page. This is a common post-upgrade configuration requirement in PAN-OS 10.2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The authentication sequence order in the profile is incorrect.
Why it's wrong here
Authentication sequence is used for multiple methods; a single LDAP profile doesn't have a sequence issue.
- ✗
The captive portal certificate is mismatched with the LDAP server certificate.
Why it's wrong here
Captive portal uses its own certificate for HTTPS; LDAP certificate is separate. A mismatch would cause a browser warning, not a login loop.
- ✓
The captive portal authentication profile is not applied to the ingress interface after the upgrade.
Why this is correct
Captive portal authentication is enforced at the interface level. If the profile is not applied, authentication may fail silently.
- ✗
The LDAP server schema has changed after the upgrade.
Why it's wrong here
PAN-OS upgrades do not affect LDAP schema; this is unrelated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.