Securing Users and Applications with Authentication practice questions

The RADIUS server profile has the wrong shared secret.

Why wrong: This would cause RADIUS authentication to fail, but the LDAP success would still complete the sequence if set to continue on failure.

The authentication policy only covers HTTP applications.

Why wrong: The authentication policy's application match does not affect which authentication factors are invoked.

The authentication sequence is set to 'continue on failure' and the LDAP authentication succeeds.

Why wrong: 'Continue on failure' means if the first factor fails, it tries the next. If LDAP succeeds, the sequence stops and RADIUS is never attempted.

The users are in a group that is excluded from authentication in the authentication profile.

Why wrong: Group exclusion would apply to the authentication profile, not prevent the prompt altogether.

The captive portal is not enabled on the interface.

Why wrong: Captive portal is part of the authentication policy action; if the policy matches, the portal is triggered regardless of interface setting.

The user-ID agent is not configured to include that group.

Why wrong: User-ID agent is not required for the authentication prompt; it only provides user mapping for logs and additional policy matching.

Disable MFA in the global Authentication Profile

Why wrong: This disables MFA for all users, not just corporate office.

Create an authentication policy with source zone 'Corporate' set to 'require MFA'

Why wrong: This would require MFA even from corporate office, not desired.

Create an authentication policy with source zone 'Corporate' set to 'no-auth' and action 'allow'

Why wrong: This would skip authentication entirely for corporate traffic, not just MFA.

The IdP does not support IdP-initiated SAML flow

Why wrong: GlobalProtect uses SP-initiated flow, so IdP-initiated is not required.

The user mapping agent is not configured

Why wrong: User mapping is for user identification, not SAML authentication.

The SAML identity provider certificate is expired

Why wrong: Expired certificate would cause a different error, not invalid assertion.

LDAP

Why wrong: LDAP is used for user mapping, not direct authentication.

NTLM

Why wrong: NTLM is less secure and often requires a proxy setup.

SAML

Why wrong: SAML typically requires a browser redirect and user interaction.

The root CA certificate is not trusted on the client

Why wrong: Root CA trust issue would show untrusted root error.

The CRL is not reachable

Why wrong: CRL issues cause revocation errors, not hash mismatch.

The GlobalProtect gateway certificate is expired

Why wrong: Expired certificate would show a different error about validity.

The Kerberos server profile 'KDC-Profile' is misconfigured

Why wrong: The error is 'user not found', not server unreachable.

The expiration time of 60 minutes is too short

Why wrong: Expiration time does not cause authentication failure.

The realm 'EXAMPLE.COM' does not match the domain 'EXAMPLE'

Why wrong: Domain and realm can be different; the configuration uses realm for Kerberos.

LDAP

Why wrong: LDAP is for user mapping, not SSO.

Local Database

Why wrong: Local database requires manual authentication.

RADIUS

Why wrong: RADIUS typically requires separate authentication, not SSO.

User-ID

Why wrong: User-ID is the outcome, not a condition for authentication policy.

Application ID

Why wrong: Application ID is not a condition in authentication policy; it is used in security policies.

Implement a secondary IdP as a fallback

Why wrong: Adding another IdP does not directly address timeout issue with Azure AD.

Reduce the SAML authentication timeout to 30 seconds to force faster responses

Why wrong: Reducing timeout would cause more failures during peak times.

Switch to certificate-based authentication instead of SAML

Why wrong: Certificate authentication avoids SAML but changes the architecture.

Change the authentication sequence to use a shorter MFA method like SMS instead of push notifications.

Why wrong: SMS may also experience similar latency or even longer delays; the core issue is the timeout duration, not the method.

Disable MFA for the Asia-Pacific region users temporarily until the MFA provider improves their latency.

Why wrong: This violates the company's MFA requirement and introduces a security risk.

Deploy a secondary MFA server instance in the Asia-Pacific region to reduce latency.

Why wrong: Deploying a secondary MFA server instance in Asia-Pacific does not address the root cause, because the timeout occurs during the authentication sequence on the firewall itself, which is located in the central data centre and must communicate with the MFA provider’s servers in the United States; latency between the user’s mobile device and a local MFA server is irrelevant when the firewall’s own connection to the MFA provider is the bottleneck. This option is tempting because geographically distributing MFA servers reduces push-notification latency for end users, which would be the correct choice if the MFA provider’s servers were the direct source of the timeout, but here the firewall’s outbound connection to the US-based MFA provider is the failing link.

LDAP authentication

Why wrong: LDAP is used for user authentication and mapping, not as an MFA method.

SAML IdP authentication

Why wrong: SAML is used for external authentication, not for local admin accounts.

Client certificate authentication

Why wrong: Client certificate can be used for authentication but is not considered an MFA method on its own.

The group should be configured as 'local' and the users should be added manually via CLI.

Why wrong: Incorrect: The users are already added manually, but the group type is still 'local'. This does not resolve the issue.

The user-id agent timeout is too short; increase the timeout value.

Why wrong: Not relevant: User-id timeout does not affect group membership resolution.

The group must be imported from LDAP as a dynamic group.

Why wrong: Incorrect: The group is already local; importing as dynamic would require changing the configuration but the issue is the group type.

The authentication policy should be set to require MFA for all users; change the policy action to 'require MFA'.

Why wrong: Incorrect: The authentication policy already triggers the authentication sequence; the issue is that MFA is not being enforced.

The authentication sequence should be reversed to 'LDAP, PingID'.

Why wrong: Incorrect: Reversing the sequence would attempt LDAP first, then PingID, which would still not enforce MFA if LDAP succeeds.

The PingID server certificate is not trusted; import the CA certificate.

Why wrong: Incorrect: The PingID service is reachable, so certificate trust is not the likely issue.

Add configuration objects, then create template, then assign template to device group, then commit template

Why wrong: This is incorrect because you cannot add configuration objects to a template before the template exists; the template must be created first.

Create template, then assign template to device group, then add configuration objects, then commit template

Why wrong: This is incorrect because assigning a template before adding configuration objects would result in an empty or incomplete template being assigned, which is not the correct workflow.

Create template, then add configuration objects, then commit template, then assign template to device group

Why wrong: This is incorrect because committing the template before assigning it to a device group would apply the template to no devices; the assignment must occur before the commit.

URL Filtering: Blocks files based on type and direction.

Why wrong: Incorrect — this describes File Blocking, not URL Filtering.

File Blocking: Categorizes URLs and controls access based on categories.

Why wrong: Incorrect — this describes URL Filtering, not File Blocking.

The authentication policy is placed in the pre-rulebase but the security policy is in post-rulebase.

Why wrong: This is a plausible configuration but if the authentication policy is in pre-rulebase, it should be evaluated before security rules. The issue is likely ordering within the same rulebase, not pre vs post.

The 'ssl' application must have a custom signature defined.

Why wrong: The 'ssl' application is predefined and does not require a custom signature.

The user-ID agent is not set to capture HTTPS traffic.

Why wrong: User-ID agent is not required for authentication policy to prompt for credentials; it is used for identity mappings but the captive portal can still trigger without it.

Create a decryption policy to decrypt all traffic.

Why wrong: Decryption does not interact with authentication enforcement.

Use identity-based routing to enforce authentication.

Why wrong: Identity-based routing is for policy-based routing, not authentication.

Enable user-ID on the ingress interface and configure authentication policy for IP addresses.

Why wrong: This is already assumed; the issue is that the existing authentication policy may not match the IP address range. More specific is needed.

LDAP authentication with a timeout.

Why wrong: LDAP authentication prompts for every new connection unless caching is used, which is not session-wide.

Captive Portal with session cookie.

Why wrong: Captive Portal typically prompts each time the cookie expires or for each new browser session, not per user session.

RADIUS authentication with one-time passwords.

Why wrong: One-time passwords provide strong security but require entering a new password each time, not a single sign-on experience.

Yes, because the sequence continues on failure and the second attempt succeeds.

Why wrong: Incorrect. The 'continue on failure' setting does not retry the same method; it only moves to the next authentication method upon a server error. A wrong password is treated as a rejection, not a failure that triggers the next method. Thus, the second correct password is never attempted.

Yes, but only if the LDAP server is configured for multiple attempts.

Why wrong: Incorrect. The configuration does not involve the LDAP server allowing multiple attempts; the authentication sequence is controlled by the firewall. Even if the LDAP server allowed retries, the firewall's sequence would stop after the first failed attempt because it treats the password mismatch as a final rejection.

No, because the first failure blocks authentication.

Why wrong: Incorrect. The first failure does block authentication, but not because it stops the sequence; it blocks because the sequence does not retry with the correct password. However, the reason is more nuanced: the 'continue on failure' option only proceeds on server errors, not on invalid credentials.