PCNSE Captive Portal Session Practice Question
An organization uses captive portal for guest Wi-Fi access with LDAP authentication against an on-premise Active Directory. Users complain that after successfully logging in, they are repeatedly prompted for credentials every few minutes. The captive portal page loads correctly and credentials are accepted initially. The authentication profile has a session timeout of 60 minutes. What is the most likely cause of the repeated prompts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's browser is set to reject all cookies.
The most likely cause is that the user's browser is configured to reject cookies. When a captive portal uses cookies to maintain the authentication session, rejecting cookies means the firewall cannot associate subsequent requests with the authenticated session. Thus, even though the initial login succeeds (because the captive portal page itself does not require a cookie for authentication), every new page load triggers a new authentication prompt. The authentication profile's session timeout of 60 minutes is irrelevant because the session is never properly established in the browser. Option D is incorrect because the stem explicitly states the session timeout is 60 minutes, not low.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user's browser is set to reject all cookies.
Why this is correct
Correct. If the browser rejects cookies, the initial authentication may succeed (the captive portal page often does not require a cookie for login), but subsequent HTTP requests lack the session cookie, causing the firewall to re-prompt for credentials on each request.
- ✗
The LDAP server is overloaded and timing out.
Why it's wrong here
Incorrect. LDAP overload might cause authentication delays or failures during login, but once authenticated, it would not cause repeated re-prompts every few minutes.
- ✗
The captive portal page is not being cached by the browser.
Why it's wrong here
Incorrect. Browser caching of the captive portal page is unrelated to session persistence; cookies or IP tracking maintain the session, not page caching.
- ✗
The session timeout on the captive portal authentication profile is set too low (e.g., 5 minutes).
Why it's wrong here
Incorrect. The stem states that the authentication profile has a session timeout of 60 minutes. If the captive portal authentication profile timeout were set to 5 minutes, it would contradict the given information; the issue is not a low timeout but a failure to maintain the session.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.