PCNSE Practice Question: Securing Users and Applications with Authentication
An administrator has configured an authentication profile with LDAP and sets the authentication sequence to 'continue on failure'. A user enters an incorrect password first, then correct. Will the user be authenticated?
⚠ Common exam trap
Many exam-takers confuse 'continue on failure' (which moves to the next authentication method after a server error) with a retry mechanism for incorrect passwords, leading them to incorrectly select Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, because the sequence stops on success, but the first attempt failed.
The authentication sequence 'continue on failure' only proceeds to the next authentication method if the current method fails (e.g., server timeout or unreachable). It does NOT retry the same LDAP server with a different password. Since the first attempt failed due to an incorrect password, the sequence stops, and the user is not authenticated. The second correct password is never attempted because the failure is treated as a final rejection, not a retry opportunity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, because the sequence continues on failure and the second attempt succeeds.
Why it's wrong here
Incorrect. The 'continue on failure' setting does not retry the same method; it only moves to the next authentication method upon a server error. A wrong password is treated as a rejection, not a failure that triggers the next method. Thus, the second correct password is never attempted.
- ✗
Yes, but only if the LDAP server is configured for multiple attempts.
Why it's wrong here
Incorrect. The configuration does not involve the LDAP server allowing multiple attempts; the authentication sequence is controlled by the firewall. Even if the LDAP server allowed retries, the firewall's sequence would stop after the first failed attempt because it treats the password mismatch as a final rejection.
- ✗
No, because the first failure blocks authentication.
Why it's wrong here
Incorrect. The first failure does block authentication, but not because it stops the sequence; it blocks because the sequence does not retry with the correct password. However, the reason is more nuanced: the 'continue on failure' option only proceeds on server errors, not on invalid credentials.
- ✓
No, because the sequence stops on success, but the first attempt failed.
Why this is correct
Correct. The authentication sequence 'continue on failure' only moves to the next method if the current method fails due to a server error (timeout, unreachable). An incorrect password is a successful authentication attempt that returns a negative result; therefore, the sequence stops, and the user is not authenticated. The second correct password is never tried.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.