PCNSE Practice Question: Securing Users and Applications with Authentication
Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?
⚠ Common exam trap
The trap here is that candidates often jump to checking the certificate (Option A) because Captive Portal uses HTTPS, but the timeout symptom specifically indicates a backend authentication server issue, not a certificate problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authentication sequence settings in the Captive Portal configuration
When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail. Checking this first isolates the issue efficiently before investigating other components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate used for the Captive Portal page
Why it's wrong here
A certificate issue causes SSL errors, not timeouts.
- ✗
The session timeout for authenticated users
Why it's wrong here
Session timeout affects post-authentication, not the auth process.
- ✓
The authentication sequence settings in the Captive Portal configuration
Why this is correct
If the sequence does not include reachable servers or has incorrect priorities, authentication requests may time out.
- ✗
The User-ID agent mapping
Why it's wrong here
User-ID agent does not affect authentication requests in Captive Portal.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.