Knowledge + Practice

CCNA Securing Users and Applications with Authentication Questions

53 questions · Securing Users and Applications with Authentication · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQeasy

A network administrator needs to authenticate users accessing the internet through the firewall using Active Directory credentials. Which authentication method should be used to transparently authenticate users without requiring a browser-based captive portal?

A.LDAP

B.NTLM

C.SAML

D.Kerberos

AnswerD

Kerberos provides transparent authentication for domain users.

Why this answer

Kerberos is the correct choice because it enables transparent, single sign-on (SSO) authentication in a Windows Active Directory domain. When a user logs into their domain-joined workstation, Kerberos obtains a Ticket-Granting Ticket (TGT) from the Key Distribution Center (KDC). The firewall can then use Kerberos authentication to verify the user's identity without requiring any browser-based captive portal, as the TGT or service ticket is presented automatically by the client.

Exam trap

The trap here is that candidates often confuse NTLM with Kerberos, assuming NTLM can also provide transparent SSO, but NTLM typically requires a browser-based challenge or fails in modern environments due to its lack of mutual authentication and reliance on weaker cryptographic methods.

How to eliminate wrong answers

Option A is wrong because LDAP is a directory access protocol used for querying and modifying directory services, not for transparent user authentication; it typically requires explicit credential submission or a bind operation. Option B is wrong because NTLM is a challenge-response authentication protocol that can work transparently in some scenarios, but it is older, less secure, and often requires a browser-based prompt or specific application support; it does not provide the seamless SSO experience that Kerberos offers in a modern AD environment. Option C is wrong because SAML is an XML-based federated identity protocol primarily used for web-based SSO across different domains; it inherently relies on a browser or HTTP redirect to a SAML identity provider, making it unsuitable for transparent authentication without a captive portal.

Practice this question →

2

MCQmedium

An organization uses captive portal for guest Wi-Fi access with LDAP authentication against an on-premise Active Directory. Users complain that after successfully logging in, they are repeatedly prompted for credentials every few minutes. The captive portal page loads correctly and credentials are accepted initially. The authentication profile has a session timeout of 60 minutes. What is the most likely cause of the repeated prompts?

A.The user's browser is set to reject all cookies.

B.The LDAP server is overloaded and timing out.

C.The captive portal page is not being cached by the browser.

D.The session timeout on the captive portal authentication profile is set too low (e.g., 5 minutes).

AnswerA

Correct. If the browser rejects cookies, the initial authentication may succeed (the captive portal page often does not require a cookie for login), but subsequent HTTP requests lack the session cookie, causing the firewall to re-prompt for credentials on each request.

Why this answer

The most likely cause is that the user's browser is configured to reject cookies. When a captive portal uses cookies to maintain the authentication session, rejecting cookies means the firewall cannot associate subsequent requests with the authenticated session. Thus, even though the initial login succeeds (because the captive portal page itself does not require a cookie for authentication), every new page load triggers a new authentication prompt.

The authentication profile's session timeout of 60 minutes is irrelevant because the session is never properly established in the browser. Option D is incorrect because the stem explicitly states the session timeout is 60 minutes, not low.

Practice this question →

3

MCQhard

After a PAN-OS upgrade from 9.1 to 10.2, users report that captive portal authentication fails consistently. The authentication profile uses LDAP and the LDAP server is reachable from the firewall. The captive portal page loads, but after entering credentials, users are redirected back to the login page. What is the most likely cause?

A.The authentication sequence order in the profile is incorrect.

B.The captive portal certificate is mismatched with the LDAP server certificate.

C.The captive portal authentication profile is not applied to the ingress interface after the upgrade.

D.The LDAP server schema has changed after the upgrade.

AnswerC

Captive portal authentication is enforced at the interface level. If the profile is not applied, authentication may fail silently.

Why this answer

After a PAN-OS upgrade, the captive portal authentication profile must be explicitly applied to the ingress interface. If it is not, the firewall will not enforce captive portal authentication on traffic entering that interface, causing the login page to load but credentials to be rejected and the user redirected back to the login page. This is a common post-upgrade configuration requirement in PAN-OS 10.2.

Exam trap

The trap here is that candidates often focus on LDAP connectivity or certificate issues, overlooking the critical post-upgrade requirement to reapply the authentication profile to the ingress interface, which is a common PAN-OS upgrade pitfall.

How to eliminate wrong answers

Option A is wrong because the authentication sequence order in the profile determines the order of authentication methods (e.g., LDAP, Kerberos, local), but it does not affect captive portal functionality after an upgrade; the issue is about interface binding, not sequence. Option B is wrong because a certificate mismatch between the captive portal and LDAP server would cause SSL/TLS errors or certificate warnings, not a redirect back to the login page after credential submission. Option D is wrong because an LDAP server schema change would cause authentication failures with error messages like 'invalid credentials' or 'user not found', not a consistent redirect to the login page, and schema changes are unrelated to a PAN-OS upgrade.

Practice this question →

4

MCQhard

Refer to the exhibit. A network administrator is troubleshooting why users are not being prompted for authentication when accessing HTTPS sites. The authentication rule and security policy are shown. What is the most likely cause?

A.The authentication rule is placed after the security policy that allows the traffic.

B.The application 'ssl' is not correctly identified.

C.The authentication rule is placed before the security policy in the rulebase.

D.The authentication profile 'AuthProfile' is not configured.

AnswerA

The authentication rule (id=1) is listed after the security rule, but the order in the output does not reflect rulebase order. However, the typical issue is that the security rule allows traffic before the authentication rule is evaluated.

Why this answer

The authentication rule is evaluated after the security policy in the rulebase (unless placed in a pre-rulebase). Since the security policy allows the HTTPS traffic without requiring authentication, users are not prompted. For authentication to be enforced, the authentication rule must be placed before the security policy or in a pre-rulebase, which corresponds to option A.

Practice this question →

5

MCQhard

A firewall administrator configured the security rule shown in the exhibit to enforce SAML authentication for web-browsing traffic from the trust zone to the untrust zone. However, users are not prompted to authenticate. What is the most likely cause?

A.SSL decryption must be enabled on the firewall for SAML to function.

B.The application must be changed from 'web-browsing' to 'ssl'.

C.A previous security rule allows web-browsing traffic without authentication enforcement.

D.The source user must be set to 'known-user' to trigger authentication.

E.The authentication profile 'saml-profile' is not associated with a valid SAML identity provider object.

AnswerE

An authentication profile used for SAML must reference a a properly configured SAML identity provider object. Without it, the firewall cannot perform SAML authentication.

Why this answer

SAML authentication requires a valid identity provider (IdP) object configured on the firewall. The authentication profile 'saml-profile' must reference an IdP object that contains the correct SAML metadata (e.g., entity ID, SSO URL, certificate). If the IdP object is missing, misconfigured, or not associated with the profile, the firewall cannot initiate the SAML flow, so users are never redirected for authentication.

Exam trap

The trap here is that candidates often assume the issue is with the rule configuration (e.g., application or source user) rather than the underlying identity provider setup, which is a separate but critical component for SAML to function.

How to eliminate wrong answers

Option A is wrong because SSL decryption is not a prerequisite for SAML authentication; SAML works over HTTPS without requiring the firewall to decrypt the traffic. Option B is wrong because the 'web-browsing' application correctly identifies HTTP/HTTPS traffic; changing it to 'ssl' would narrow the match to only SSL/TLS handshake traffic, not the full web session. Option C is wrong because a previous rule allowing web-browsing without authentication would only be a factor if it matched before the SAML rule; however, the question implies the SAML rule is in place, and the issue is that authentication is not triggered at all, not that it is bypassed by an earlier rule.

Option D is wrong because setting the source user to 'known-user' would require pre-existing authentication (e.g., from a captive portal or previous SAML session), which creates a circular dependency; the correct source user setting to trigger SAML is 'any' or a specific user, not 'known-user'.

Practice this question →

6

Multi-Selectmedium

An administrator is configuring authentication for a captive portal. Which two configuration steps are necessary? (Choose two.)

Select 2 answers

A.Enable user-ID on the interface where users connect.

B.Configure a security policy to allow the captive portal traffic before authentication.

C.Create an authentication policy matching the captive portal traffic.

D.Configure a captive portal profile with an external authentication server.

E.Import the captive portal certificate.

AnswersC, D

The authentication policy triggers the captive portal for matching traffic.

Why this answer

An authentication policy must be created to match the captive portal traffic and trigger authentication. This policy defines which traffic requires authentication and specifies the authentication profile to use. Without it, the firewall will not know to intercept the user's HTTP request and redirect them to the captive portal login page.

Exam trap

The trap here is that candidates often confuse the need for User-ID (option A) or a pre-authentication security policy (option B) with the actual requirements for captive portal, when in fact the authentication policy and captive portal profile with an external server are the two mandatory steps.

Practice this question →

7

MCQmedium

A company wants to enforce MFA for VPN users but allow users to authenticate without MFA when connecting from the corporate office. Which authentication policy configuration achieves this?

A.Disable MFA in the global Authentication Profile

B.Create an authentication policy with source zone 'Corporate' set to 'require MFA'

C.Create an authentication policy with source zone 'Corporate' set to 'allow' and authentication method 'no MFA'

D.Create an authentication policy with source zone 'Corporate' set to 'no-auth' and action 'allow'

AnswerC

This allows authentication without MFA from the corporate zone.

Why this answer

It creates an authentication policy that explicitly allows users from the 'Corporate' source zone to authenticate without MFA by setting the authentication method to 'no MFA'. This meets the requirement of enforcing MFA for VPN users (typically from untrusted zones) while exempting corporate office users. The authentication policy evaluates the source zone and applies the specified authentication method, overriding the global authentication profile for matching traffic.

Exam trap

Palo Alto Networks often tests the distinction between 'no MFA' (authenticate without multi-factor) and 'no-auth' (bypass authentication entirely), and candidates frequently confuse these two options, thinking they achieve the same result.

How to eliminate wrong answers

Option A is wrong because disabling MFA in the global Authentication Profile would remove MFA enforcement for all users, including VPN users, which fails the requirement to enforce MFA for VPN users. Option B is wrong because setting the source zone 'Corporate' to 'require MFA' would force corporate office users to use MFA, which is the opposite of the requirement to allow them to authenticate without MFA. Option D is wrong because setting the source zone 'Corporate' to 'no-auth' and action 'allow' would bypass authentication entirely for corporate users, which does not meet the requirement to allow authentication without MFA—it skips authentication altogether, which is a security risk and not the same as authenticating without MFA.

Practice this question →

8

Multi-Selecthard

Which THREE factors should be considered when designing an authentication policy for a multi-zone environment with varied security requirements? (Choose THREE.)

Select 3 answers

A.Source zone

B.User-ID

C.Schedule

D.Application ID

E.Destination zone

AnswersA, C, E

Source zone is a key condition in authentication policies.

Why this answer

A is correct because source zone is a critical factor in authentication policy design, as it determines which traffic entering from specific zones (e.g., Untrust, DMZ) must be authenticated. In a multi-zone environment, different zones have varying trust levels, so authentication policies must be scoped to source zones to enforce access controls appropriately. Without source zone consideration, traffic from low-trust zones could bypass authentication, violating security requirements.

Exam trap

The trap here is that candidates often confuse User-ID as a design factor for authentication policies, when in fact User-ID is a post-authentication mapping mechanism, not a condition that defines when authentication is triggered.

Practice this question →

9

MCQeasy

A company wants to authenticate users who are accessing internal applications from the internet through a firewall. The users should be prompted once per session. Which authentication solution best meets this requirement?

A.SAML authentication with single sign-on.

B.LDAP authentication with a timeout.

C.Captive Portal with session cookie.

D.RADIUS authentication with one-time passwords.

AnswerA

SAML SSO allows users to authenticate once and access multiple applications without re-prompting for credentials.

Why this answer

SAML authentication with single sign-on (SSO) allows users to authenticate once per session via an external identity provider (IdP). The firewall validates the SAML assertion and maintains the session, so users are not prompted again until the session expires or is terminated. This meets the requirement of a single prompt per session without re-authentication.

Exam trap

The trap here is that candidates often confuse 'session cookie' (Option C) with single sign-on, but Captive Portal cookies only cover the firewall's own session tracking and do not provide federated authentication across multiple applications, whereas SAML SSO does.

How to eliminate wrong answers

Option B is wrong because LDAP authentication with a timeout does not inherently provide single sign-on; it requires the firewall to prompt for credentials on each new session or after timeout, not once per session. Option C is wrong because Captive Portal with session cookie still prompts the user for credentials at the start of each new TCP connection or after cookie expiration, and it does not provide true session-level single sign-on across applications. Option D is wrong because RADIUS authentication with one-time passwords (OTP) requires a new OTP for each authentication attempt, which would prompt the user multiple times per session, not once.

Practice this question →

10

MCQmedium

Which of the following is required for SAML-based single sign-on to work with a Palo Alto Networks firewall acting as the service provider?

A.The identity provider's metadata must be imported into the firewall.

B.A certificate from a public CA for the SAML identity provider.

C.The firewall must be configured as a SAML identity provider.

D.User-ID must be configured to poll the SAML identity provider.

AnswerA

The metadata includes the IdP's public key, endpoints, and binding information needed for SAML communication.

Why this answer

For SAML-based single sign-on (SSO) with a Palo Alto Networks firewall acting as the service provider (SP), the firewall must trust the identity provider (IdP). This trust is established by importing the IdP's SAML metadata (which includes the IdP's entity ID, single sign-on URL, and signing certificate) into the firewall. Without this metadata, the firewall cannot validate SAML assertions from the IdP, making authentication impossible.

Exam trap

The trap here is that candidates often assume a public CA certificate is required for SAML trust (Option B), but in reality, SAML uses a direct trust model where the SP explicitly trusts the IdP's self-signed certificate via metadata import, not through a public PKI hierarchy.

How to eliminate wrong answers

Option B is wrong because the certificate used for SAML signing by the IdP does not need to come from a public CA; it can be a self-signed certificate, as the trust is established via the metadata import, not via a public CA chain. Option C is wrong because the firewall is acting as the service provider (SP), not the identity provider (IdP); configuring it as an IdP would be for scenarios where the firewall itself authenticates users, not for SP-initiated SSO. Option D is wrong because User-ID does not need to poll the SAML IdP; SAML SSO provides user identity information directly in the SAML assertion, which the firewall can use to map to a User-ID without polling.

Practice this question →

11

MCQeasy

When configuring an authentication policy, which match criteria is required to trigger authentication?

A.Application must be 'web-browsing'.

B.Destination address must be the server IP.

C.Source user must be set to 'any'.

D.Source zone must be specified.

AnswerD

Source zone is a required parameter in authentication policy to define the inbound traffic zone.

Why this answer

In a PAN-OS authentication policy, the source zone is a required match criterion because the firewall must know which ingress zone the traffic is coming from to apply the correct authentication profile and enforce the policy. Without a specified source zone, the policy cannot be evaluated, as zone-based forwarding is fundamental to how the firewall processes traffic. This ensures that authentication is triggered only for traffic entering through a designated zone, such as an untrust or internal zone.

Exam trap

The trap here is that candidates often assume the source user must be 'any' to match all users, but the correct required match is the source zone, as authentication policies are zone-based and the source user field is typically left as 'unknown' to trigger authentication for unauthenticated traffic.

How to eliminate wrong answers

Option A is wrong because the application 'web-browsing' is not a required match criterion; authentication policies can be triggered for various applications, and the policy matches traffic based on zone, user, and destination, not a specific application. Option B is wrong because the destination address is optional; while you can specify a server IP to narrow the scope, authentication can be triggered without it, and the policy can match any destination. Option C is wrong because source user set to 'any' is not required; in fact, authentication policies are designed to match unauthenticated users (source user 'unknown') to trigger authentication, and setting it to 'any' would include already-authenticated users, defeating the purpose.

Practice this question →

12

MCQhard

You are a network security engineer for a multinational corporation with users in different regions. The company uses GlobalProtect for remote access and requires multi-factor authentication (MFA) using a mobile app for all users. Recently, users in the Asia-Pacific region have reported intermittent failures when authenticating via GlobalProtect. The symptoms include: after entering credentials on the GlobalProtect portal, the authentication challenge from the MFA provider times out after 30 seconds, and the user is disconnected. Users in other regions do not experience this issue. The GlobalProtect gateways and portals are configured with Authentication Profile that uses an LDAP server for primary authentication and an MFA vendor as authentication sequence. The MFA provider sends push notifications to users' mobile devices. The firewall logs show no errors related to LDAP or MFA, but the GlobalProtect logs indicate authentication timeouts. The firewall is located in the central data center, and the MFA provider's servers are in the United States. What should you do to resolve this issue?

A.Change the authentication sequence to use a shorter MFA method like SMS instead of push notifications.

B.Disable MFA for the Asia-Pacific region users temporarily until the MFA provider improves their latency.

C.Increase the authentication timeout in the GlobalProtect portal and gateway configuration from 30 seconds to 60 seconds.

D.Deploy a secondary MFA server instance in the Asia-Pacific region to reduce latency.

AnswerC

Increasing the timeout accommodates the higher latency for users in Asia-Pacific, allowing the MFA push to complete.

Why this answer

The authentication timeout in the GlobalProtect portal and gateway configuration defaults to 30 seconds, which is insufficient when high latency exists between the firewall (central data center) and the MFA provider's servers (United States). Users in the Asia-Pacific region experience additional network latency, causing the MFA push notification challenge to exceed the 30-second timeout. Increasing the timeout to 60 seconds accommodates this latency without altering the authentication method or requiring additional infrastructure.

Exam trap

The trap here is that candidates often assume the issue is with the MFA method or provider latency, leading them to choose option A or D, when in fact the problem is a misconfigured timeout value that is easily adjustable within the GlobalProtect portal and gateway settings.

How to eliminate wrong answers

Option A is wrong because changing from push notifications to SMS does not address the root cause—latency-induced timeout; SMS may actually introduce additional delays due to carrier routing and is less secure. Option B is wrong because disabling MFA for a region violates security policy and leaves those users vulnerable; it is a temporary workaround that does not solve the underlying latency issue. Option D is wrong because deploying a secondary MFA server instance in the Asia-Pacific region is an expensive and complex solution that is unnecessary when simply increasing the authentication timeout resolves the problem, and the MFA provider's servers are not under the company's control.

Practice this question →

13

MCQmedium

A company uses a Palo Alto Networks firewall with Authentication Policy to enforce MFA for external users accessing a web application via GlobalProtect. The authentication sequence is set to 'PingID, LDAP'. Recently, users report that after entering their LDAP credentials, they are not prompted for PingID MFA and are allowed access immediately. The firewall logs show that the authentication policy is hit and the authentication method used is 'LDAP' only. The PingID service is reachable from the firewall. The administrator checks the Authentication Profile and sees that PingID is configured correctly. What is the most likely cause of this issue?

A.The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

B.The authentication sequence should be reversed to 'LDAP, PingID'.

C.The PingID server certificate is not trusted; import the CA certificate.

D.The PingID agent is configured to allow fallback to LDAP on authentication failure; disable fallback in the PingID agent settings.

AnswerD

Correct: If PingID allows fallback, the firewall will proceed to LDAP without MFA.

Why this answer

The PingID agent can be configured to fall back to LDAP authentication when PingID MFA fails or is unreachable. Even though the firewall can reach the PingID service, if the PingID agent itself is set to allow fallback on authentication failure, it will silently skip the MFA challenge and complete authentication via LDAP only, matching the log entry showing 'LDAP' as the authentication method.

Exam trap

The trap here is that candidates assume MFA bypass is always due to firewall misconfiguration (like sequence order or certificate issues), when in reality the PingID agent's fallback behavior can silently skip MFA even when the firewall and network connectivity are correctly configured.

How to eliminate wrong answers

Option A is wrong because the authentication policy action 'require MFA' is not a valid setting; authentication policies use actions like 'allow' or 'deny', and MFA enforcement is controlled by the authentication profile's sequence, not a policy-level MFA toggle. Option B is wrong because reversing the sequence to 'LDAP, PingID' would cause LDAP to be attempted first, and if successful, the firewall would not proceed to PingID MFA, which would still bypass MFA; the correct sequence is 'PingID, LDAP' to ensure MFA is attempted before LDAP fallback. Option C is wrong because the PingID server certificate trust issue would cause a certificate validation error, not a silent skip of MFA; the firewall would log an authentication failure or error, not a successful LDAP-only authentication.

Practice this question →

14

Drag & Dropmedium

Arrange the steps to deploy a new Panorama template to a managed firewall.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for deploying a new Panorama template to a managed firewall is: first, create the template; second, add configuration objects such as interfaces and zones; third, assign the template to the relevant device group; and finally, commit the template to push the configuration to the managed firewalls. This order ensures that the template exists, contains the desired settings, is linked to the correct devices, and is then applied.

Practice this question →

15

MCQeasy

A company wants to enforce multi-factor authentication (MFA) for all administrative access to the Palo Alto Networks firewall. They have a RADIUS server configured with MFA capability (e.g., RSA SecurID). The firewall is currently using local authentication for admin accounts. What must be configured to enforce MFA for admin access?

A.Create a security policy to allow RADIUS traffic from the firewall to the RADIUS server.

B.Enable MFA in the User-ID agent configuration.

C.Create an authentication profile using RADIUS with MFA enabled and assign it to the admin accounts.

D.Configure an authentication enforcement rule in the authentication policy.

AnswerC

The authentication profile defines how the firewall authenticates users. By using RADIUS with MFA, the firewall will prompt for the second factor.

Why this answer

To enforce MFA for administrative access using a RADIUS server with MFA capability, you must create an authentication profile that specifies RADIUS as the authentication method with MFA enabled. This authentication profile is then assigned to each admin account or to the admin role. Option A is incorrect because a security policy is not required for the firewall to communicate with the RADIUS server; the firewall's management interface initiates outbound RADIUS traffic, which is typically allowed by default.

Option B is incorrect because User-ID agent configuration is for user mapping, not admin authentication. Option D is incorrect because authentication enforcement rules are for end-user traffic, not administrative access.

Practice this question →

16

Multi-Selecteasy

Which TWO authentication methods are supported for captive portal on a Palo Alto Networks firewall?

Select 3 answers

A.SAML

B.TACACS+

C.RADIUS

D.Local Database

E.Kerberos

AnswersA, C, D

SAML is supported and often used for federated SSO.

Why this answer

SAML enables browser-based SSO using an external IdP. RADIUS is widely used for network authentication and integrates with existing RADIUS servers. Local Database allows authentication against local user entries on the firewall.

All three methods are supported for captive portal; the question requires any two.

Exam trap

A common trap is assuming only SAML and RADIUS are supported. Local Database is also a valid method, so if the question asks for two, any combination of SAML, RADIUS, and Local Database qualifies. TACACS+ and Kerberos are not supported for captive portal.

Practice this question →

17

MCQhard

An organization needs to enforce authentication for application-based policies. Users are in multiple AD groups. Which authentication enforcement method best scales and minimizes administrative overhead?

A.Single Sign-On with Kerberos

B.Captive Portal with RADIUS

C.SSL Decryption with User-ID

D.GlobalProtect with client certificate

E.Authentication Policy with user group mapping

AnswerE

Authentication Policy can match source-user groups from LDAP, scaling easily with group membership.

Why this answer

Authentication Policy with user group mapping (Option E) is the correct answer because it allows the firewall to enforce authentication based on user group membership without requiring per-user credentials at the firewall. By integrating with Active Directory via LDAP or Kerberos, the firewall can map users to groups and apply authentication policies that scale across thousands of users, minimizing administrative overhead as group changes are automatically reflected.

Exam trap

The trap here is that candidates often confuse User-ID (which passively maps users to IPs) with Authentication Policy (which actively enforces authentication), leading them to choose SSL Decryption or Kerberos SSO as the enforcement mechanism rather than the policy that triggers the authentication challenge.

How to eliminate wrong answers

Option A is wrong because Single Sign-On with Kerberos provides seamless authentication for users but does not inherently enforce authentication for application-based policies; it relies on the firewall already having user identity, and Kerberos alone does not trigger an authentication challenge for policy enforcement. Option B is wrong because Captive Portal with RADIUS requires users to manually authenticate via a web portal, which does not scale well for large AD groups and adds administrative overhead for managing RADIUS attributes and group mappings. Option C is wrong because SSL Decryption with User-ID is used for decrypting SSL traffic to identify users, not for enforcing authentication; User-ID can identify users passively but does not enforce authentication challenges.

Option D is wrong because GlobalProtect with client certificate authenticates the device or user via certificates, but it is designed for remote access VPN and does not efficiently scale for enforcing authentication on internal application-based policies across multiple AD groups without additional infrastructure.

Practice this question →

18

MCQhard

Refer to the exhibit. A firewall administrator created a local user group named 'Engineering' and added two users. However, when applying a security policy that uses this group as the source user, only one user (asmith) is matched correctly. What is the most likely cause of this issue?

A.The group should be configured as 'local' and the users should be added manually via CLI.

B.The user-id agent timeout is too short; increase the timeout value.

C.The group type is set to 'local' but the users are sourced from LDAP; change the group type to 'ldap'.

D.The group must be imported from LDAP as a dynamic group.

AnswerC

Correct: The group type should match the source of the users. Local groups expect locally defined users; LDAP-sourced users require the group type to be 'ldap'.

Why this answer

When a local user group is created on the firewall, the group type must match the source of its members. If the group type is set to 'local', the firewall expects the users to be defined locally on the firewall itself. However, if the users are actually sourced from an external LDAP directory, the group type must be changed to 'ldap' so that the firewall queries the LDAP server for group membership.

The mismatch causes the firewall to fail to resolve the LDAP users as members of the local group, resulting in only locally defined users (like asmith) being matched correctly.

Exam trap

The trap here is that candidates assume adding LDAP usernames to a local group will work because the usernames are known, but they overlook that the group type must match the authentication source for the firewall to correctly resolve group membership.

How to eliminate wrong answers

Option A is wrong because local groups and users are already created via the GUI or CLI; the issue is not about the method of creation but about the group type mismatch. Option B is wrong because the user-id agent timeout affects how long user mappings are cached, not whether LDAP users are recognized as members of a local group. Option D is wrong because the group does not need to be imported as a dynamic group; static LDAP groups can be used by simply setting the group type to 'ldap' and referencing the LDAP group name.

Practice this question →

19

MCQhard

A company needs to authenticate remote users accessing internal web applications via GlobalProtect portal and wants to use SAML with Azure AD for MFA. Which component must be configured on the firewall?

A.LDAP server profile for user lookup

B.Server certificate for the portal

C.Authentication profile referencing the SAML IdP profile

D.SSL decryption rule

AnswerC

The authentication profile defines the method (SAML) and must include the IdP profile.

Why this answer

SAML authentication for GlobalProtect requires an authentication profile that references a SAML identity provider (IdP) profile. The firewall uses this profile to redirect users to Azure AD for SAML-based MFA, then validates the SAML assertion returned. Without this profile, the firewall cannot initiate or complete the SAML exchange.

Exam trap

The trap here is that candidates often confuse the need for a server certificate (required for TLS) with the authentication method itself, or assume LDAP is needed for user identity, but SAML authentication is configured solely through the authentication profile and SAML IdP profile, not through LDAP or SSL decryption.

How to eliminate wrong answers

Option A is wrong because an LDAP server profile is used for direct user lookup or authentication against an LDAP directory, not for SAML-based authentication with Azure AD; SAML relies on token exchange, not LDAP binds. Option B is wrong because a server certificate for the portal is required for TLS encryption of the GlobalProtect portal, but it does not enable SAML authentication or MFA; it secures the transport layer only. Option D is wrong because SSL decryption rules are used to inspect encrypted traffic, not to configure authentication methods; they have no role in SAML or MFA integration.

Practice this question →

20

MCQeasy

A multinational corporation uses Palo Alto Networks NGFWs to secure user access to cloud-based productivity applications. Users authenticate via SAML using an external identity provider. Recently, the helpdesk has received multiple complaints that when users log in to the first application in the morning, they are prompted for SAML authentication. After authenticating successfully, if they navigate to a different application (e.g., from email to document editing) within the same browser tab, they are again prompted to re-authenticate, which disrupts their workflow. The firewall authentication logs show that each application access triggers a new SAML authentication request, even though the user’s session is still active. The administrator has verified that the SAML identity provider is properly configured, and the authentication profile on the firewall uses a unique identifier per user. The company wants to minimize re-authentication prompts while maintaining security. Which action should the administrator take?

A.Enable Single Logout (SLO) on the identity provider and configure the firewall to accept SLO requests.

B.Configure a session token lifetime in the authentication profile so that the firewall can reuse the same authentication token across multiple applications.

C.Reduce the authentication timeout value in the authentication profile to force more frequent re-authentication.

D.Remove the authentication enforcement from the security rules for these applications and rely on user-IP mapping.

AnswerB

Setting a session token lifetime allows the firewall to cache the SAML token and reuse it for subsequent authentications within the specified period, thus reducing redundant prompts.

Why this answer

Configuring a session token lifetime in the authentication profile allows the firewall to cache the SAML authentication token and reuse it for subsequent application requests within the same user session. This prevents redundant SAML re-authentication prompts when the user navigates between different cloud applications in the same browser tab, as the firewall can validate the existing token against the configured lifetime instead of initiating a new SAML flow.

Exam trap

The trap here is that candidates often confuse session token reuse with Single Logout (SLO) or think that reducing timeout values improves performance, when in fact the correct solution is to extend the token caching duration to avoid redundant SAML handshakes.

How to eliminate wrong answers

Option A is wrong because enabling Single Logout (SLO) is designed to terminate all active sessions when a user logs out, which would not reduce re-authentication prompts; it would actually increase them by forcing logout and re-login. Option C is wrong because reducing the authentication timeout value would force more frequent re-authentication, exacerbating the problem rather than solving it. Option D is wrong because removing authentication enforcement and relying solely on user-IP mapping bypasses SAML-based identity verification, weakening security and potentially allowing unauthorized access if IP addresses change or are shared.

Practice this question →

21

Multi-Selecthard

Which TWO are prerequisites for using Authentication Policy? (Choose two.)

Select 2 answers

A.User-ID is configured

B.The firewall is in transparent mode

C.SSL decryption is enabled

D.A security policy rule exists with user attributes

E.An authentication profile is configured

AnswersA, E

User-ID is required to map users to IP addresses and use user attributes in policies.

Why this answer

User-ID must be configured because Authentication Policy relies on user identity information to enforce access controls based on who the user is, not just IP addresses. Without User-ID, the firewall cannot map users to traffic, making authentication policies ineffective. This prerequisite ensures the firewall can identify users via agents, captive portal, or other methods.

Exam trap

The trap here is that candidates often confuse prerequisites with features that enhance security (like SSL decryption) or confuse the order of configuration steps, thinking a security rule with user attributes must exist before the authentication policy can be used.

Practice this question →

22

MCQmedium

Refer to the exhibit. A user is trying to authenticate via SAML and receives this error. What is the most likely cause?

A.The IdP certificate has expired.

B.The user's account is locked.

C.The SAML request timeout is set too short.

D.The firewall's SP entity ID does not match the audience configured in the IdP.

AnswerD

The audience in the SAML response must match the SP entity ID; otherwise, the firewall rejects it.

Why this answer

The error typically indicates a SAML assertion mismatch. The firewall (SP) validates that the `Audience` element in the SAML assertion matches its own SP entity ID. If they differ, the firewall rejects the assertion, causing this authentication failure.

Exam trap

Palo Alto often tests the distinction between SAML assertion validation errors (audience mismatch) and certificate/account issues, tempting candidates to confuse a configuration mismatch with a credential or certificate problem.

How to eliminate wrong answers

Option A is wrong because an expired IdP certificate would cause a signature validation failure, not an audience mismatch error. Option B is wrong because a locked user account would produce a different error (e.g., 'user not found' or 'account disabled') before SAML processing. Option C is wrong because a SAML request timeout would result in a 'request expired' or 'response too late' error, not an audience mismatch.

Practice this question →

23

Multi-Selecteasy

Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)

Select 2 answers

A.Application type

B.Time of day

C.User group membership

D.Source IP address

E.Destination port

AnswersA, C

Authentication can be enforced per application, e.g., only for web-browsing.

Why this answer

Authentication enforcement in Palo Alto Networks is configured via Authentication Policies, which support match criteria such as source user, source IP, destination IP, application, service/port, and schedule (time of day). While many factors are possible, the most important considerations when designing an authentication enforcement strategy are the type of application being accessed (to determine if authentication is required) and the user group membership (to apply different authentication requirements to different user groups). Time of day and source IP are secondary factors that can be used for fine-tuning but are not primary design factors.

Exam trap

The trap here is that candidates often confuse factors used in Security Policies (like time of day or source IP) with those used in Authentication Policies, leading them to select options that are valid for security rules but not for authentication enforcement.

Practice this question →

24

Multi-Selectmedium

Which THREE components are required to deploy the Palo Alto Networks User-ID agent in a typical Windows environment to map users to IP addresses?

Select 3 answers

A.Firewall management server (Panorama)

B.Active Directory domain to query user information

C.LDAP server (non-AD) for authentication

D.User-ID agent software installed on a Windows server

E.Mapping database for storing IP-to-user mappings

AnswersB, D, E

AD provides user identity data.

Why this answer

In a typical Windows environment, the User-ID agent requires Active Directory (AD) to query user logon events and group memberships. The agent uses the AD domain to correlate user SIDs with IP addresses via NetAPI or WMI, enabling accurate IP-to-user mapping without requiring a separate LDAP server for authentication.

Exam trap

The trap here is that candidates often confuse the User-ID agent's need for Active Directory with a general LDAP server, or assume Panorama is a required component for the agent to function, when in fact the agent can operate with just a firewall and AD.

Practice this question →

25

MCQhard

A large enterprise with 10,000+ users is deploying GlobalProtect with SAML authentication. The IdP is Azure AD. Users report that authentication sometimes fails during peak hours with error 'SAML response timeout'. Which design change would most effectively address this issue?

A.Implement a secondary IdP as a fallback

B.Reduce the SAML authentication timeout to 30 seconds to force faster responses

C.Switch to certificate-based authentication instead of SAML

D.Increase the SAML authentication timeout to 120 seconds

AnswerD

Longer timeout accommodates IdP response delays during peak load.

Why this answer

Increasing the SAML authentication timeout to 120 seconds accommodates delays in Azure AD response generation during peak loads. The default timeout (often 60 seconds) may be insufficient when the IdP is under heavy demand, causing the firewall to abort the SAML exchange prematurely. Extending the timeout allows the IdP more time to complete the assertion, reducing timeout errors without altering the authentication method.

Exam trap

The trap here is that candidates may think reducing the timeout improves performance, but in reality, it increases failures when the IdP is slow, while increasing the timeout is the correct remedy for IdP-side latency.

How to eliminate wrong answers

Option A is wrong because adding a secondary IdP as a fallback does not address the root cause—slow responses from the primary IdP during peak hours; it only shifts the problem to another IdP that may also experience delays. Option B is wrong because reducing the SAML authentication timeout to 30 seconds would exacerbate the issue, causing even more frequent timeouts when the IdP is slow. Option C is wrong because switching to certificate-based authentication abandons SAML entirely, which is a drastic change that does not solve the specific timeout issue and may not meet the enterprise's requirement for SAML-based single sign-on.

Practice this question →

26

Multi-Selectmedium

A company wants to enforce multi-factor authentication (MFA) for employees accessing a specific internal application through the firewall. Which two configurations are required on the Palo Alto Networks firewall? (Choose two.)

Select 2 answers

A.Define an authentication profile that includes an MFA method

B.Configure a SAML identity provider

C.Create an authentication policy rule that references the application

D.Install the GlobalProtect client on user endpoints

E.Enable SSL decryption on the firewall

AnswersA, C

The authentication profile defines the authentication method (e.g., MFA via OTP or SAML) and must be configured to provide the second factor.

Why this answer

An authentication profile on a Palo Alto Networks firewall defines the authentication method(s) to be used, including MFA via RADIUS with one-time passwords (OTP), LDAP with OTP, or built-in MFA. This profile is then applied within an authentication policy rule to enforce MFA for specific traffic. Option C is correct because an authentication policy rule specifies the criteria (e.g., source zone, user, destination application) that triggers authentication, and it references the authentication profile containing the MFA method.

Without this rule, the firewall would not know which traffic requires MFA.

Exam trap

The trap here is that candidates often confuse authentication policy rules with security policy rules, or assume that MFA always requires GlobalProtect or SAML, when in fact the firewall can enforce MFA directly via captive portal using an authentication profile and policy rule.

Practice this question →

27

MCQmedium

A cloud-based application is accessed via URL filtering and uses SAML authentication. After a user changes their password in the identity provider (Okta), they are unable to authenticate to the application. The firewall is configured with an authentication policy that uses SAML. Other users who have not changed passwords can authenticate successfully. What is the most likely issue?

A.The User-ID mapping on the firewall is outdated and still contains the user's old credentials.

B.The SAML token for the user has expired.

C.The firewall's SAML certificate is invalid.

D.The application does not support password changes.

AnswerA

The firewall might have cached the user's authentication state; clearing the user mapping or re-authenticating can resolve the issue.

Why this answer

When a user changes their password in Okta, the SAML assertion generated for authentication includes a new session tied to the updated credentials. However, the firewall's User-ID mapping may still cache the user's previous authentication state (including old session tokens or credentials). This stale mapping causes the firewall to reject the new SAML assertion because it does not match the cached user identity, preventing successful authentication.

Other users without password changes have consistent mappings, so they authenticate normally.

Exam trap

The trap here is that candidates often focus on SAML token expiration or certificate issues, overlooking the fact that User-ID mapping caches authentication state independently of the SAML assertion lifecycle, causing a mismatch after credential changes.

How to eliminate wrong answers

Option B is wrong because SAML token expiration would affect all users equally, not just the one who changed their password, and the scenario specifies other users can authenticate. Option C is wrong because an invalid SAML certificate would cause authentication failures for all users, not selectively for a single user after a password change. Option D is wrong because the application's support for password changes is irrelevant; the issue is with the firewall's User-ID mapping, not the application's password change capability.

Practice this question →

28

MCQmedium

An organization uses Microsoft Active Directory for User-ID mapping. Some users are not being mapped because their IP addresses change frequently due to DHCP. Which approach should be implemented to ensure these users are identified?

A.Increase the IP-to-user mapping timeout

B.Use GlobalProtect with pre-logon token

C.Deploy a User-ID agent with WMI probing

D.Configure an Authentication Policy to enforce user authentication for their traffic

AnswerD

When users authenticate, the firewall maps their current IP to the user.

Why this answer

An Authentication Policy enforces user authentication for traffic, which triggers the firewall to learn the user-to-IP mapping in real time via authentication logs. This approach works regardless of DHCP changes, as each new IP address is immediately associated with the authenticated user. It is the most reliable method for environments with dynamic IP assignments.

Exam trap

The trap here is that candidates often assume increasing the timeout (Option A) is sufficient, but they overlook that DHCP changes cause the mapping to become stale, and only active authentication (Option D) ensures real-time mapping updates.

How to eliminate wrong answers

Option A is wrong because increasing the IP-to-user mapping timeout only delays the expiration of stale mappings, but does not solve the root issue of frequent IP changes; users will still be unmapped once the timeout expires. Option B is wrong because GlobalProtect with pre-logon token is designed for remote access scenarios and requires the GlobalProtect client, not for internal DHCP-based IP changes; it does not address local network user mapping. Option C is wrong because WMI probing relies on querying the domain controller for user-to-IP mappings, which can be slow and may not capture rapid DHCP changes; it also requires additional configuration and may fail if the DC is not updated in real time.

Practice this question →

29

MCQhard

A large enterprise uses GlobalProtect with SAML authentication integrated with Azure AD for remote access. Users on laptops report intermittent authentication failures when moving between different office locations or switching wireless access points. The firewall clusters are geographically distributed and connected via MPLS. The authentication policy is configured correctly and the SAML identity provider is reachable. What should the administrator check first to resolve the issue?

A.Increase the SAML session timeout on the identity provider to 24 hours.

B.Configure authentication caching at the firewall to store user credentials.

C.Enable persistent cookie for GlobalProtect authentication to maintain session continuity.

D.Verify that the client certificate is not expiring and is properly installed.

AnswerC

Persistent cookies allow the firewall to recognize the user even after IP changes, preventing re-authentication.

Why this answer

Persistent cookies maintain the SAML session across IP changes, which is common when users roam between networks. Option A might help but is not a direct solution for IP changes. Option B is unrelated.

Option D does not affect SAML authentication.

Practice this question →

30

MCQhard

A security architect needs to enforce authentication for all application-based policies using an external authentication source with MFA. Which combination of features best achieves this?

A.Local user database with password policies

B.SAML authentication with an identity provider that supports MFA

C.Kerberos authentication with Active Directory

D.RADIUS authentication with one-time passwords via token

AnswerB

SAML allows the firewall to redirect users to the IdP for authentication, including MFA challenges.

Why this answer

B is correct because SAML authentication with an identity provider (IdP) that supports MFA allows the firewall to offload authentication to an external IdP, which can enforce multi-factor authentication (MFA) before granting access. This meets the requirement for application-based policies to use an external authentication source with MFA, as SAML provides a standards-based (SAML 2.0) mechanism for the firewall to trust the IdP's authentication assertions, including MFA status.

Exam trap

Palo Alto Networks often tests the distinction between authentication methods for network access (RADIUS, Kerberos) versus application access (SAML), and the trap here is that candidates may choose RADIUS (option D) because it supports MFA via OTP, but fail to recognize that SAML is the correct choice for application-based policies with external MFA integration.

How to eliminate wrong answers

Option A is wrong because the local user database is internal to the firewall and does not support external authentication sources or MFA; it only supports simple password-based authentication without multi-factor capabilities. Option C is wrong because Kerberos authentication with Active Directory provides single sign-on (SSO) but does not natively support MFA; it relies on ticket-based authentication and cannot enforce additional factors like OTP or biometrics without additional infrastructure. Option D is wrong because RADIUS authentication with one-time passwords via token can provide MFA, but it is typically used for network access (e.g., VPN, 802.1X) rather than application-based policies; the firewall's application-based policy enforcement is better suited to SAML for web-based applications, and RADIUS does not integrate as seamlessly with modern application authentication flows.

Practice this question →

31

MCQhard

After configuring SAML authentication for GlobalProtect, users report they are repeatedly prompted for credentials even though they already authenticated via the IdP. The firewall logs show 'saml-auth-success' but the portal log shows 'user-login-failure: invalid saml assertion'. What is the most likely cause?

A.The IdP does not support IdP-initiated SAML flow

B.The user mapping agent is not configured

C.The firewall and IdP system clocks are out of sync

D.The SAML identity provider certificate is expired

AnswerC

Time skew can cause SAML assertion validation failure.

Why this answer

The firewall logs show 'saml-auth-success' (meaning the IdP successfully authenticated the user and issued a SAML assertion), but the portal log shows 'user-login-failure: invalid saml assertion'. This indicates the firewall received the assertion but rejected it as invalid. The most common cause for a validly signed assertion to be rejected is clock skew between the firewall and the IdP, because SAML assertions contain timestamps (NotBefore and NotOnOrAfter conditions) that are checked against the local system clock.

If the clocks differ by more than the allowed skew (typically 5 minutes), the assertion is considered invalid even though it was correctly signed.

Exam trap

The trap here is that candidates see 'saml-auth-success' and assume the authentication succeeded end-to-end, but they miss that the firewall's portal log rejection indicates a validation failure on the assertion itself, not a failure at the IdP.

How to eliminate wrong answers

Option A is wrong because IdP-initiated SAML flow is not required for GlobalProtect; GlobalProtect uses SP-initiated SAML flow, where the firewall (service provider) redirects the user to the IdP. The error here is about assertion validation, not about which party initiated the flow. Option B is wrong because the user mapping agent is used for mapping IP addresses to usernames for policy enforcement, not for SAML authentication validation; the error occurs during the SAML assertion validation phase, before any user mapping would occur.

Option D is wrong because if the IdP certificate were expired, the firewall would fail to validate the signature on the SAML assertion and would log a signature validation error, not an 'invalid saml assertion' error; the logs show 'saml-auth-success' from the IdP side, meaning the certificate was valid at the time of signing.

Practice this question →

32

MCQeasy

An administrator has configured an authentication profile with LDAP and sets the authentication sequence to 'continue on failure'. A user enters an incorrect password first, then correct. Will the user be authenticated?

A.Yes, because the sequence continues on failure and the second attempt succeeds.

B.Yes, but only if the LDAP server is configured for multiple attempts.

C.No, because the first failure blocks authentication.

D.No, because the sequence stops on success, but the first attempt failed.

AnswerD

Correct. The authentication sequence 'continue on failure' only moves to the next method if the current method fails due to a server error (timeout, unreachable). An incorrect password is a successful authentication attempt that returns a negative result; therefore, the sequence stops, and the user is not authenticated. The second correct password is never tried.

Why this answer

The authentication sequence 'continue on failure' only proceeds to the next authentication method if the current method fails (e.g., server timeout or unreachable). It does NOT retry the same LDAP server with a different password. Since the first attempt failed due to an incorrect password, the sequence stops, and the user is not authenticated.

The second correct password is never attempted because the failure is treated as a final rejection, not a retry opportunity.

Exam trap

The trap here is that candidates confuse 'continue on failure' (which moves to the next authentication method after a server error) with a retry mechanism for incorrect passwords, leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because 'continue on failure' does not mean the user can retry with a different password on the same LDAP server; it only moves to the next authentication method (e.g., another LDAP server or local database) if the first method fails due to a connectivity or server error, not due to invalid credentials. Option B is wrong because the LDAP server configuration for multiple attempts is irrelevant; the Palo Alto Networks firewall's authentication sequence controls retries, and the sequence does not retry the same server with a corrected password. Option C is wrong because the first failure does not block authentication in all cases; it blocks authentication only because the failure is due to invalid credentials, not because the sequence stops unconditionally.

Practice this question →

33

MCQmedium

An organization uses captive portal authentication. Users report that after closing the browser, they are still authenticated and can access resources without re-authenticating. How can the administrator enforce re-authentication after browser closure?

A.Clear the 'allow session cookie' option in the captive portal profile.

B.Configure the authentication enforcement to require authentication for each session.

C.Set the session timeout to 0 in the captive portal profile.

D.Disable the 'session cookie' setting in the captive portal profile and change the authentication profile to use RADIUS.

AnswerA

This disables the session cookie, so when the browser is closed, the session ends and re-authentication is required.

Why this answer

Captive portal uses a session cookie to maintain authentication. Clearing the 'allow session cookie' option forces the user to authenticate for each new browser session. Option A is correct.

Practice this question →

34

MCQeasy

An administrator wants to enforce authentication for SSL decrypted traffic so that only authenticated users can access decrypted content. Which firewall feature should be configured?

A.SSL Inbound Inspection

B.Authentication Policy

C.User-ID agent

D.SSL Forward Proxy

AnswerB

Authentication Policy enforces user authentication before allowing traffic, including SSL decrypted traffic.

Why this answer

Authentication Policy is the correct feature because it allows the firewall to enforce user authentication specifically for SSL decrypted traffic. By configuring an Authentication Policy, the firewall can require users to authenticate before accessing decrypted content, ensuring that only authenticated users can proceed. This is distinct from SSL decryption profiles, which handle the decryption itself but not user access control.

Exam trap

The trap here is that candidates often confuse SSL Forward Proxy (which handles decryption) with Authentication Policy (which handles user access control), leading them to select the decryption feature instead of the authentication enforcement feature.

How to eliminate wrong answers

Option A is wrong because SSL Inbound Inspection is used to decrypt inbound traffic destined for protected servers, not to enforce authentication for decrypted content. Option C is wrong because the User-ID agent is responsible for mapping users to IP addresses for visibility and policy enforcement, but it does not enforce authentication for decrypted traffic. Option D is wrong because SSL Forward Proxy decrypts outbound SSL traffic for inspection, but it does not enforce user authentication; it only enables decryption.

Practice this question →

35

MCQmedium

An administrator configured the authentication profile shown. Users in the domain 'EXAMPLE' are unable to authenticate; logs show 'Authentication failed: user not found'. What is the likely issue?

A.The 'allow-list' is restricting authentication to only user1 and user2

B.The Kerberos server profile 'KDC-Profile' is misconfigured

C.The expiration time of 60 minutes is too short

D.The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

AnswerA

Only those two users are allowed; others are denied.

Why this answer

The authentication profile includes an 'allow-list' that explicitly restricts authentication to only 'user1' and 'user2'. When a user from the 'EXAMPLE' domain attempts to authenticate, the firewall checks the allow-list first; since the user is not in that list, the authentication fails with the 'user not found' error, even if the user exists in the domain.

Exam trap

The trap here is that candidates often assume 'user not found' always indicates a domain or Kerberos misconfiguration, overlooking the allow-list feature that explicitly blocks users not listed.

How to eliminate wrong answers

Option B is wrong because the Kerberos server profile 'KDC-Profile' being misconfigured would typically result in a different error, such as 'Kerberos authentication failed' or 'KDC unreachable', not 'user not found'. Option C is wrong because the expiration time of 60 minutes affects session timeout, not the initial authentication lookup; a short expiration would cause re-authentication prompts, not a 'user not found' error. Option D is wrong because the realm 'EXAMPLE.COM' and the domain 'EXAMPLE' are not required to match exactly; the realm is used for Kerberos, while the domain is a Windows domain name, and the firewall can map them via the authentication profile settings.

Practice this question →

36

MCQmedium

A company uses GlobalProtect with SAML authentication. Users report being redirected to the IdP login page repeatedly even after successfully authenticating. What is the most likely cause?

A.The authentication policy is misconfigured.

B.The SAML cookie expiration timeout in the GlobalProtect gateway configuration is set too short.

C.The IdP session timeout is set too short.

D.The IdP certificate has expired.

AnswerB

The gateway's SAML cookie timeout determines how long the authenticated session persists; if too short, users are redirected to the IdP frequently.

Why this answer

When SAML authentication succeeds but the user is repeatedly redirected to the IdP login page, the most likely cause is that the GlobalProtect gateway's SAML cookie expiration timeout is set too short. This timeout controls how long the gateway retains the SAML authentication assertion; once it expires, the gateway treats the session as unauthenticated and forces a new SAML authentication flow, even though the IdP session may still be valid. The symptom of repeated redirects after successful login points to the gateway-side timeout, not the IdP-side timeout.

Exam trap

The trap here is that candidates often assume the issue is with the IdP (session timeout or certificate) because the symptom involves the IdP login page, but the root cause is actually the GlobalProtect gateway's SAML cookie expiration timeout being too short, which is a gateway-side setting, not an IdP-side setting.

How to eliminate wrong answers

Option A is wrong because a misconfigured authentication policy would typically prevent authentication from succeeding at all or would deny access, not cause repeated redirects after successful authentication. Option C is wrong because if the IdP session timeout were too short, the user would be prompted to re-authenticate at the IdP level, but the symptom here is repeated redirects to the IdP login page even after successful authentication, which indicates the gateway is not honoring the already-established SAML session. Option D is wrong because an expired IdP certificate would cause SAML assertion validation failures and authentication errors, not repeated successful authentications followed by redirects.

Practice this question →

37

Multi-Selecthard

A security architect is designing authentication for a hybrid workforce with both on-premises and remote users. Which three best practices should be implemented? (Choose three.)

Select 3 answers

A.Use SAML SSO for cloud applications.

B.Implement user-ID via domain controller probing.

C.Use the same authentication profile for all traffic.

D.Configure multi-factor authentication for VPN access.

E.Deploy captive portal only for on-premises users.

AnswersA, B, D

SAML SSO provides seamless authentication for cloud applications.

Why this answer

SAML SSO enables centralized identity federation for cloud applications, allowing both on-premises and remote users to authenticate via a single identity provider (IdP) without exposing on-premises credentials to the cloud. This reduces password fatigue and improves security by leveraging token-based authentication (SAML 2.0 assertions) rather than shared secrets.

Exam trap

A common misconception is that captive portal should only be used for on-premises users, but in Palo Alto Networks environments, it should be applied consistently across all segments, including remote users connecting via GlobalProtect or other VPN clients.

Practice this question →

38

MCQeasy

A security admin receives reports that some users are bypassing authentication by manually setting a different IP address. Which feature can enforce that only users who have authenticated through the firewall can access resources?

A.Authentication Policy requiring authentication for all traffic

B.GlobalProtect client certificate authentication

C.Security policy using source-user attribute

D.Captive Portal with cookie-based authentication

AnswerA

Authentication Policy forces users to authenticate before traffic is allowed, preventing IP-based bypass.

Why this answer

Authentication Policy enforces authentication for all traffic, ensuring that only authenticated users can access resources regardless of their IP address. This prevents bypassing by manually setting a different IP. Option B (GlobalProtect client certificate authentication) does not prevent IP spoofing as certificates are tied to devices, not IPs.

Option C (Security policy using source-user attribute) relies on User-ID mapping, which can be spoofed if the IP is changed before mapping. Option D (Captive Portal with cookie-based authentication) can be bypassed if the user does not go through the portal or if cookies are manipulated.

Practice this question →

39

Matchingmedium

Match each security profile type to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Detects and blocks malware in traffic

Prevents spyware and command-and-control traffic

Blocks exploits targeting known vulnerabilities

Controls access to websites based on category

Blocks specific file types from being transferred

Why these pairings

The correct matches are: Antivirus scans for malware, Anti-Spyware protects against spyware, Vulnerability Protection prevents exploitation. URL Filtering categorizes URLs, and File Blocking blocks file types. Options D and E swap these definitions.

Practice this question →

40

MCQhard

Refer to the exhibit. What happens when a user with an unknown identity (source-user unknown) tries to access resources in 192.168.1.0/24?

A.The traffic is blocked because the source-user is 'unknown'.

B.The traffic is allowed without authentication because the source-user is 'unknown'.

C.The user is prompted to authenticate via the configured authentication profile.

D.The user is redirected to the captive portal.

AnswerC

The 'allow-authentication' action initiates an authentication challenge for the user.

Why this answer

When a user with an unknown identity (source-user unknown) attempts to access resources in 192.168.1.0/24 and the policy rule action is 'allow-authentication', the firewall prompts the user to authenticate via the configured authentication profile. Option A is incorrect because the action is not 'deny', so traffic is not blocked solely due to unknown source-user. Option B is incorrect because the traffic is not allowed without authentication; the 'allow-authentication' action requires successful authentication.

Option D is incorrect because the action is specifically 'allow-authentication' which triggers an authentication prompt using the configured method (which may be captive portal, but the term 'redirect to captive portal' is less precise than 'prompted to authenticate').

Practice this question →

41

Multi-Selecteasy

Which TWO authentication methods support single sign-on (SSO) capabilities in Palo Alto Networks firewalls?

Select 2 answers

A.LDAP

B.Local Database

C.Kerberos

D.RADIUS

E.SAML

AnswersC, E

Kerberos provides transparent SSO for domain users.

Why this answer

Kerberos (option C) supports SSO because it uses ticket-based authentication where the client obtains a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) and presents it to the firewall without re-entering credentials. SAML (option E) supports SSO by exchanging signed XML assertions between an identity provider (IdP) and the firewall, enabling browser-based federated single sign-on.

Exam trap

The trap here is that candidates often assume RADIUS or LDAP support SSO because they are common authentication protocols, but neither provides the ticket or assertion exchange required for true single sign-on; only Kerberos and SAML implement SSO mechanisms in Palo Alto firewalls.

Practice this question →

42

Multi-Selectmedium

When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)

Select 2 answers

A.less mp-log authd.log

B.show running security-policy

C.show user user-id count

D.show authentication rule matching traffic from the user's IP

E.show system resources

AnswersA, D

This log file contains detailed authentication daemon messages including failures and mismatches.

Why this answer

The `authd.log` file contains detailed authentication daemon logs, including credential challenges, authentication successes, and failures. When users are not prompted for credentials, this log reveals whether the firewall is even attempting to authenticate the user or if the request is being bypassed due to policy misconfiguration. Option D is correct because the `show authentication rule matching traffic from the user's IP` command allows you to test which authentication policy rule applies to a specific user's traffic, helping identify if the rule is missing, misordered, or incorrectly configured to skip credential prompting.

Exam trap

A common misconception in Palo Alto Networks environments is that security policies control authentication prompts, when in fact authentication is governed by a separate authentication policy that must be explicitly configured to trigger credential challenges.

Practice this question →

43

MCQeasy

An administrator configures an authentication policy to require authentication for the 'ssl' application. After committing, the firewall does not prompt users for credentials when they access HTTPS sites. Which step is most likely missing?

A.The authentication policy is placed in the pre-rulebase but the security policy is in post-rulebase.

B.The 'ssl' application must have a custom signature defined.

C.The authentication policy must be placed before the security rule that allows the web-browsing traffic.

D.The user-ID agent is not set to capture HTTPS traffic.

AnswerC

Authentication policies are evaluated in order relative to security rules. If the security rule allowing the traffic appears before the authentication rule, users are not prompted.

Why this answer

When an authentication policy is configured for the 'ssl' application, the firewall must identify the traffic as matching that rule before it reaches the security policy processing. Authentication policies are evaluated prior to security policies, but they exist in a separate rulebase. If the authentication policy rule is not correctly ordered within its own rulebase, or if it is not properly matched, the firewall will proceed to the security policy and possibly allow the traffic without authentication.

One common oversight is not placing the authentication policy rule in a position where it will be evaluated before the traffic is permitted by a broad security rule, such as one allowing web-browsing. In this case, the authentication policy must be placed before the security rule that allows web-browsing traffic, meaning it must be processed first in the firewall's evaluation order.

Exam trap

A common misconception is that authentication policies and security policies share the same rulebase order, but they are separate. Authentication policies are evaluated before security policies, and their ordering among themselves is critical to ensure that authentication is enforced before traffic is allowed by any security rule.

How to eliminate wrong answers

Option A is wrong because the authentication policy is always evaluated in the pre-rulebase, regardless of where the security policy is placed; the issue is the order within the rulebase, not the rulebase location. Option B is wrong because the 'ssl' application is a predefined application in Palo Alto Networks firewalls and does not require a custom signature; it is identified by the firewall's App-ID engine. Option D is wrong because the User-ID agent is not required to capture HTTPS traffic for authentication purposes; the firewall can prompt for credentials using captive portal or other methods without a User-ID agent.

Practice this question →

44

MCQmedium

Refer to the exhibit. The administrator committed this configuration but users cannot authenticate via SAML. What is the problem?

A.The authentication profile has two methods configured, causing a conflict.

B.The firewall is not configured as a service provider.

C.The SAML identity provider certificate is missing.

D.The SAML logout URL is incorrect.

AnswerA

Only one method (or sequence) can be set; the second 'method ldap' overwrites 'method saml'.

Why this answer

The authentication profile has two 'method' commands; the second one overwrites the first, so the profile ends up using LDAP instead of SAML. This causes a conflict and prevents SAML authentication. Therefore, Option A is correct.

Practice this question →

45

MCQeasy

To reduce the number of authentication prompts for users accessing multiple applications through the firewall, which configuration is recommended?

A.Increase the authentication timeout value

B.Enable session cookies in the authentication policy

C.Use certificate-based authentication

D.Disable authentication for commonly used applications

AnswerB

Session cookies maintain authentication state and reduce prompts.

Why this answer

Enabling session cookies in the authentication policy allows the firewall to store a session cookie on the user's browser after the first successful authentication. This cookie is then presented for subsequent requests to different applications, eliminating repeated authentication prompts. The firewall validates the cookie against the existing user session, providing a seamless single sign-on (SSO) experience without requiring re-authentication for each application.

Exam trap

The trap here is that candidates often confuse increasing the authentication timeout (Option A) with reducing prompts, but timeout only extends the session lifespan, not the number of prompts per application; the key is the session cookie mechanism that ties all application requests to a single authenticated session.

How to eliminate wrong answers

Option A is wrong because increasing the authentication timeout value only extends the duration a user remains authenticated, but it does not prevent repeated prompts when accessing multiple applications; each new application request still triggers authentication unless a session cookie is used. Option C is wrong because certificate-based authentication eliminates passwords but does not inherently reduce the number of authentication prompts across multiple applications; each application still requires a separate certificate exchange unless combined with session cookies. Option D is wrong because disabling authentication for commonly used applications bypasses security controls entirely, leaving those applications unprotected and violating the principle of least privilege.

Practice this question →

46

MCQhard

An organization has deployed GlobalProtect with certificate authentication. Users on macOS report that after updating their client, they cannot connect and see error 'Certificate validation failed: The certificate hash does not match.' What is the most likely cause?

A.The certificate pinning configuration on the gateway has a hash mismatch

B.The root CA certificate is not trusted on the client

C.The CRL is not reachable

D.The GlobalProtect gateway certificate is expired

AnswerA

Certificate pinning enforces specific hash; client update may change the hash.

Why this answer

The error 'Certificate validation failed: The certificate hash does not match' specifically indicates a certificate pinning mismatch. GlobalProtect certificate pinning allows the gateway to enforce that the client's certificate matches a specific hash (SHA-256 fingerprint). When the client updates, its certificate may change (e.g., due to a new key pair or renewal), causing the hash stored in the gateway's pinning configuration to no longer match, resulting in this exact error.

Exam trap

The trap here is that candidates often confuse certificate pinning failures with general certificate validation issues (like trust or expiry), but the specific error message 'certificate hash does not match' is unique to pinning and not to standard PKI validation steps.

How to eliminate wrong answers

Option B is wrong because if the root CA certificate were not trusted on the client, the error would typically be 'untrusted root' or 'certificate not trusted', not a hash mismatch. Option C is wrong because an unreachable CRL would cause a revocation check failure (e.g., 'CRL not available' or 'certificate revoked'), not a hash mismatch. Option D is wrong because an expired gateway certificate would produce an 'expired certificate' error, not a hash mismatch; the hash mismatch error is specific to the client certificate's fingerprint not matching the pinned value.

Practice this question →

47

MCQmedium

A company is migrating to cloud-based SaaS applications and wants to enforce SAML-based authentication with single logout. They have a Palo Alto firewall running the latest PAN-OS. What is the recommended configuration to enable SAML authentication for these applications?

A.Create an authentication profile with SAML identity provider and assign it to the application.

B.Configure GlobalProtect with SAML authentication to access the SaaS applications.

C.Use the User-ID agent to synchronize SAML sessions between the identity provider and the firewall.

D.Configure a SAML identity provider profile and create an authentication policy that enforces SAML authentication for the applications.

AnswerD

The authentication policy defines which applications require authentication and which authentication profile to use. SAML is supported for web applications.

Why this answer

To enforce SAML-based authentication with single logout for cloud-based SaaS applications on a Palo Alto firewall, you must configure a SAML identity provider (IdP) profile and then create an authentication policy that matches the traffic to those applications and enforces SAML authentication. The authentication policy is the mechanism that triggers the SAML flow, including single logout, for specific traffic, rather than assigning a profile directly to an application or relying on GlobalProtect or User-ID.

Exam trap

The trap here is that candidates confuse authentication profiles (used for firewall management access) with authentication policies (used to enforce SAML on traffic), leading them to choose Option A instead of D.

How to eliminate wrong answers

Option A is wrong because authentication profiles define how users authenticate to the firewall itself (e.g., for management access or captive portal), not for enforcing SAML authentication on traffic to SaaS applications; you need an authentication policy to apply SAML to specific traffic. Option B is wrong because GlobalProtect is a remote access VPN solution that can use SAML for its own authentication, but it does not enforce SAML authentication for third-party SaaS applications accessed by users. Option C is wrong because the User-ID agent maps IP addresses to usernames and can integrate with SAML IdPs for user mapping, but it does not enforce SAML authentication or single logout for application traffic; that requires an authentication policy.

Practice this question →

48

Multi-Selecteasy

An organization wants to enforce multi-factor authentication (MFA) for administrative access to the Palo Alto Networks firewall. Which TWO authentication methods are supported for local administrator accounts?

Select 2 answers

A.LDAP authentication

B.SAML IdP authentication

C.One-time password (OTP) via RADIUS

D.Time-based one-time password (TOTP)

E.Client certificate authentication

AnswersC, D

Correct: OTP via RADIUS is a supported MFA method for local admin accounts.

Why this answer

Palo Alto Networks firewalls support one-time password (OTP) authentication for local administrator accounts via RADIUS, where the RADIUS server generates and validates the OTP. Option D is correct because time-based one-time password (TOTP) is natively supported for local administrator MFA, using RFC 6238 to generate time-synchronized codes that the firewall validates directly without an external server.

Exam trap

The trap here is that candidates often confuse authentication methods that support MFA for local administrator accounts with those used for external user authentication (e.g., SAML or LDAP), mistakenly thinking any external IdP can be applied to local accounts, when in fact only TOTP and RADIUS-based OTP are supported for local admin MFA.

Practice this question →

49

MCQhard

A security administrator notices that users are able to bypass authentication by accessing resources using IP addresses instead of FQDNs, even though authentication policies are configured. How can this be prevented?

A.Create a decryption policy to decrypt all traffic.

B.Use identity-based routing to enforce authentication.

C.Enable user-ID on the ingress interface and configure authentication policy for IP addresses.

D.Configure an authentication policy with source user 'unknown' to enforce authentication for all unmapped IP addresses.

AnswerD

By default, authentication policies match on source user 'any', so if a user mapping exists, the policy applies. Setting source user to 'unknown' ensures that traffic from IPs without a user mapping triggers authentication.

Why this answer

When users access resources by IP address rather than FQDN, the firewall cannot associate the traffic with a specific user via normal authentication policies (which rely on domain-based rules). By configuring an authentication policy with source user 'unknown', the firewall forces authentication for all unmapped IP addresses, ensuring that even IP-based access triggers user identification and policy enforcement.

Exam trap

The trap here is that candidates often assume enabling User-ID on the interface or using decryption will solve the bypass, but they miss the critical detail that authentication policies must explicitly target unmapped IPs via the 'unknown' source user to enforce authentication for IP-based access.

How to eliminate wrong answers

Option A is wrong because decryption policies are used to inspect encrypted traffic, not to enforce authentication for IP-based access. Option B is wrong because identity-based routing controls traffic forwarding based on user identity but does not enforce authentication for unmapped IP addresses. Option C is wrong because enabling User-ID on the ingress interface and configuring authentication policy for IP addresses does not address the core issue; the firewall still requires a user mapping, and IP addresses alone bypass the authentication policy unless the source user is set to 'unknown'.

Practice this question →

50

MCQhard

Refer to the exhibit. A user at IP 10.10.1.11 is unable to access internal resources that require authentication. The firewall logs show 'no user mapping' for traffic from this IP. Which step should the administrator take first?

A.Configure an authentication policy to trigger captive portal for that IP.

B.Verify that the User-ID agent has network access to the client at 10.10.1.11.

C.Check the Kerberos keytab file.

D.Manually create a static mapping for IP 10.10.1.11.

AnswerB

If the User-ID agent cannot communicate with the client or domain controller, no mapping is created.

Why this answer

The 'no user mapping' error indicates that the firewall cannot correlate the IP address (10.10.1.11) with a username. The first step is to verify that the User-ID agent can reach the client, because without network connectivity, the agent cannot collect user mappings via probing (e.g., WMI, NetBIOS, or terminal services). Option B directly addresses this root cause.

Exam trap

The trap here is that candidates often jump to configuring authentication policies or static mappings without first verifying the basic connectivity between the User-ID agent and the client, which is the most common root cause of missing user mappings.

How to eliminate wrong answers

Option A is wrong because configuring an authentication policy to trigger captive portal would require the user to actively authenticate, but the issue is that the firewall already lacks a user mapping for the IP; captive portal is a separate mechanism and not the first troubleshooting step. Option C is wrong because checking the Kerberos keytab file is relevant only if the firewall is configured for Kerberos-based authentication (e.g., for GlobalProtect or captive portal), but the core problem is missing user mapping, not a keytab misconfiguration. Option D is wrong because manually creating a static mapping is a workaround, not a diagnostic step; the administrator should first determine why the User-ID agent is not mapping the IP dynamically.

Practice this question →

51

MCQmedium

Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?

A.The certificate used for the Captive Portal page

B.The session timeout for authenticated users

C.The authentication sequence settings in the Captive Portal configuration

D.The User-ID agent mapping

AnswerC

If the sequence does not include reachable servers or has incorrect priorities, authentication requests may time out.

Why this answer

When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail.

Checking this first isolates the issue efficiently before investigating other components.

Exam trap

The trap here is that candidates often jump to checking the certificate (Option A) because Captive Portal uses HTTPS, but the timeout symptom specifically indicates a backend authentication server issue, not a certificate problem.

How to eliminate wrong answers

Option A is wrong because a certificate issue would typically cause SSL/TLS errors or browser warnings, not authentication request timeouts; the firewall would still process the request but the page might not load securely. Option B is wrong because session timeout controls how long an authenticated user remains active, not the initial authentication process; changing it would not affect the timeout of authentication requests. Option D is wrong because the User-ID agent mapping is used to map IP addresses to usernames after authentication, not to process the initial Captive Portal authentication requests; a timeout during authentication points to the authentication server or sequence, not the mapping agent.

Practice this question →

52

Multi-Selectmedium

Which THREE components are part of the GlobalProtect infrastructure? (Choose three.)

Select 3 answers

A.Firewall management interface

B.GlobalProtect Gateway

C.GlobalProtect Client

D.GlobalProtect Portal

E.Authentication server

AnswersB, C, D

Gateway is the component that routes traffic and enforces policies.

Why this answer

The GlobalProtect infrastructure consists of three core components: the GlobalProtect Portal, GlobalProtect Gateway, and GlobalProtect Client. The Portal manages client configurations and authentication, the Gateway enforces security policies and terminates VPN tunnels, and the Client is the endpoint software that connects to the Gateway. These three components work together to provide secure remote access.

Exam trap

The trap here is that candidates often confuse external dependencies (like authentication servers or management interfaces) with the core GlobalProtect components, leading them to select options that are not part of the defined infrastructure.

Practice this question →

53

MCQeasy

Refer to the exhibit. Which configuration is required in the authentication profile 'SAML-Auth'?

A.SAML identity provider profile

B.LDAP server profile

C.RADIUS server

D.Kerberos realm

AnswerA

The authentication profile must include an IdP profile for SAML to work.

Why this answer

The exhibit shows a SAML-based authentication flow where the firewall redirects the user to an external identity provider (IdP) for authentication. The authentication profile 'SAML-Auth' must reference a SAML identity provider profile to define the IdP metadata, entity ID, SSO URL, and certificate binding. Without this profile, the firewall cannot initiate or validate SAML assertions, making option A the only correct choice.

Exam trap

Palo Alto Networks emphasizes the distinction between authentication profiles (which define the authentication method) and server profiles (which define server connections). Candidates often mistakenly select LDAP or RADIUS profiles instead of the SAML identity provider profile required for SAML-based authentication.

How to eliminate wrong answers

Option B is wrong because LDAP server profiles are used for direct LDAP bind authentication against an on-premises directory, not for SAML-based federated authentication. Option C is wrong because RADIUS server profiles are used for RADIUS-based authentication (e.g., with 802.1X or VPN), which does not support SAML assertions or IdP redirection. Option D is wrong because Kerberos realms are used for Kerberos-based authentication (typically with Active Directory in a domain environment), not for SAML identity provider configuration.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Securing Users and Applications with Authentication questions.

Start 20-question session