PCNSE Practice Question: Securing Users and Applications with Authentication

Exhibit

set authentication profile "SAML-Profile" method saml
set authentication profile "SAML-Profile" saml-identity-provider "AzureAD"
set authentication profile "SAML-Profile" saml-logout-url "https://login.microsoftonline.com/logout"
set authentication profile "SAML-Profile" method ldap

Refer to the exhibit. The administrator committed this configuration but users cannot authenticate via SAML. What is the problem?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The authentication profile has two methods configured, causing a conflict.

The authentication profile has two 'method' commands; the second one overwrites the first, so the profile ends up using LDAP instead of SAML. This causes a conflict and prevents SAML authentication. Therefore, Option A is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The authentication profile has two methods configured, causing a conflict.
Why this is correct
Only one method (or sequence) can be set; the second 'method ldap' overwrites 'method saml'.
✗
The firewall is not configured as a service provider.
Why it's wrong here
The firewall is configured as a service provider by specifying the SAML identity provider; the exhibit shows that.
✗
The SAML identity provider certificate is missing.
Why it's wrong here
While a certificate is needed, the exhibit does not show any certificate configuration, but the immediate problem is the method conflict.
✗
The SAML logout URL is incorrect.
Why it's wrong here
The logout URL does not affect authentication; it's used for single logout only.

Go deeper

PCNSE Practice Question: Securing Users and Applications with Authentication

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question