PCNSE Practice Question: Securing Users and Applications with Authentication
Users are unable to authenticate via Captive Portal. The firewall receives authentication requests but they time out. What should be checked first?
⚠ Common exam trap
The trap here is that candidates often jump to checking the certificate (Option A) because Captive Portal uses HTTPS, but the timeout symptom specifically indicates a backend authentication server issue, not a certificate problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authentication sequence settings in the Captive Portal configuration
When the firewall receives authentication requests but they time out, the most common cause is a misconfigured authentication sequence. The authentication sequence defines the order of authentication methods (e.g., local database, RADIUS, LDAP) and their timeout settings. If the sequence is incorrect or the servers are unreachable, the firewall will wait for a response until the timeout expires, causing the Captive Portal authentication to fail. Checking this first isolates the issue efficiently before investigating other components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate used for the Captive Portal page
Why it's wrong here
A certificate problem would surface as a browser trust warning before authentication, not as request timeouts after the firewall receives credentials. Certificates are checked when the portal page fails to load or shows errors, so this is premature here.
- ✗
The session timeout for authenticated users
Why it's wrong here
Session timeout governs how long an already-authenticated user remains mapped; it cannot cause an initial authentication request to time out. It is tempting because timeouts are mentioned, but this setting applies after successful login, not during the portal exchange.
- ✓
The authentication sequence settings in the Captive Portal configuration
Why this is correct
Authentication requests reach the firewall but time out, indicating the firewall cannot reach an authentication service. The authentication sequence defines which servers are queried and in what order, so a misconfigured or unreachable sequence entry is the first thing to verify.
- ✗
The User-ID agent mapping
Why it's wrong here
User-ID agent mapping resolves usernames to IP addresses for policy enforcement; it plays no part in Captive Portal authentication, which the firewall itself handles. It is tempting because User-ID problems also cause authentication-looking failures, but timeouts on portal requests point to connectivity, DNS, or certificate issues instead.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 319 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.