PCNSE Practice Question: Securing Users and Applications with Authentication
Which of the following is required for SAML-based single sign-on to work with a Palo Alto Networks firewall acting as the service provider?
⚠ Common exam trap
Watch out — candidates often assume a public CA certificate is required for SAML trust (Option B), but in reality, SAML uses a direct trust model where the SP explicitly trusts the IdP's self-signed certificate via metadata import, not through a public PKI hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The identity provider's metadata must be imported into the firewall.
For SAML-based single sign-on (SSO) with a Palo Alto Networks firewall acting as the service provider (SP), the firewall must trust the identity provider (IdP). This trust is established by importing the IdP's SAML metadata (which includes the IdP's entity ID, single sign-on URL, and signing certificate) into the firewall. Without this metadata, the firewall cannot validate SAML assertions from the IdP, making authentication impossible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The identity provider's metadata must be imported into the firewall.
Why this is correct
Importing the identity provider's metadata supplies the firewall with the IdP's signing certificate, entity ID and SSO endpoint, which it needs to validate SAML assertions and redirect authentication requests. Without this trust anchor, the service provider cannot verify responses, so the metadata import satisfies the SAML configuration requirement.
- ✗
A certificate from a public CA for the SAML identity provider.
Why it's wrong here
The identity provider's signing certificate is uploaded to the firewall to validate assertions; it need not come from a public CA, since self-signed or internal CA certificates are accepted. It is tempting because public CA certificates are standard for externally facing TLS, which is a separate trust requirement.
- ✗
The firewall must be configured as a SAML identity provider.
Why it's wrong here
The firewall acts as the service provider, receiving assertions from an external identity provider; configuring it as the identity provider inverts the roles and breaks the assertion flow. It is tempting because the firewall does hold the user and group data used for policy, which suits it as an identity source in other designs.
- ✗
User-ID must be configured to poll the SAML identity provider.
Why it's wrong here
User-ID polling retrieves mappings from directory servers such as Active Directory; SAML authentication delivers user identity within the assertion itself, so polling the identity provider is unnecessary. It is tempting because User-ID is central to firewall policy, and polling is correct for non-SAML directory integration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.