PCNSE Practice Question: Securing Users and Applications with Authentication
When troubleshooting an authentication issue where users are not prompted for credentials, which two logs or commands would be most useful? (Choose two.)
⚠ Common exam trap
A common misconception in Palo Alto Networks environments is that security policies control authentication prompts, when in fact authentication is governed by a separate authentication policy that must be explicitly configured to trigger credential challenges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
less mp-log authd.log
The `authd.log` file contains detailed authentication daemon logs, including credential challenges, authentication successes, and failures. When users are not prompted for credentials, this log reveals whether the firewall is even attempting to authenticate the user or if the request is being bypassed due to policy misconfiguration. Option D is correct because the `show authentication rule matching traffic from the user's IP` command allows you to test which authentication policy rule applies to a specific user's traffic, helping identify if the rule is missing, misordered, or incorrectly configured to skip credential prompting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
less mp-log authd.log
Why this is correct
This log file contains detailed authentication daemon messages including failures and mismatches.
- ✗
show running security-policy
Why it's wrong here
Security policy does not directly affect authentication prompt; it shows allow/deny rules.
- ✗
show user user-id count
Why it's wrong here
Shows number of user mappings but does not indicate why authentication is not triggering.
- ✓
show authentication rule matching traffic from the user's IP
Why this is correct
This command simulates traffic to see if an authentication rule matches.
- ✗
show system resources
Why it's wrong here
System resources are unrelated to authentication troubleshooting.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.