PCNSE Practice Question: Securing Users and Applications with Authentication
An administrator configures an authentication policy to require authentication for the 'ssl' application. After committing, the firewall does not prompt users for credentials when they access HTTPS sites. Which step is most likely missing?
⚠ Common exam trap
A common misconception is that authentication policies and security policies share the same rulebase order, but they are separate. Authentication policies are evaluated before security policies, and their ordering among themselves is critical to ensure that authentication is enforced before traffic is allowed by any security rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authentication policy must be placed before the security rule that allows the web-browsing traffic.
When an authentication policy is configured for the 'ssl' application, the firewall must identify the traffic as matching that rule before it reaches the security policy processing. Authentication policies are evaluated prior to security policies, but they exist in a separate rulebase. If the authentication policy rule is not correctly ordered within its own rulebase, or if it is not properly matched, the firewall will proceed to the security policy and possibly allow the traffic without authentication. One common oversight is not placing the authentication policy rule in a position where it will be evaluated before the traffic is permitted by a broad security rule, such as one allowing web-browsing. In this case, the authentication policy must be placed before the security rule that allows web-browsing traffic, meaning it must be processed first in the firewall's evaluation order.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The authentication policy is placed in the pre-rulebase but the security policy is in post-rulebase.
Why it's wrong here
This is a plausible configuration but if the authentication policy is in pre-rulebase, it should be evaluated before security rules. The issue is likely ordering within the same rulebase, not pre vs post.
- ✗
The 'ssl' application must have a custom signature defined.
Why it's wrong here
The 'ssl' application is predefined and does not require a custom signature.
- ✓
The authentication policy must be placed before the security rule that allows the web-browsing traffic.
Why this is correct
Authentication policies are evaluated in order relative to security rules. If the security rule allowing the traffic appears before the authentication rule, users are not prompted.
- ✗
The user-ID agent is not set to capture HTTPS traffic.
Why it's wrong here
User-ID agent is not required for authentication policy to prompt for credentials; it is used for identity mappings but the captive portal can still trigger without it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.