PCNSE Practice Question: Securing Users and Applications with Authentication
Which TWO factors should be considered when designing an authentication enforcement strategy? (Choose two.)
⚠ Common exam trap
Many candidates confuse factors used in Security Policies (like time of day or source IP) with those used in Authentication Policies, leading them to select options that are valid for security rules but not for authentication enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application type
Authentication enforcement in Palo Alto Networks is configured via Authentication Policies, which support match criteria such as source user, source IP, destination IP, application, service/port, and schedule (time of day). While many factors are possible, the most important considerations when designing an authentication enforcement strategy are the type of application being accessed (to determine if authentication is required) and the user group membership (to apply different authentication requirements to different user groups). Time of day and source IP are secondary factors that can be used for fine-tuning but are not primary design factors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application type
Why this is correct
Authentication can be enforced per application, e.g., only for web-browsing.
- ✗
Time of day
Why it's wrong here
Time-based enforcement is not a standard factor for authentication policy.
- ✓
User group membership
Why this is correct
Group membership is commonly used to enforce authentication based on roles.
- ✗
Source IP address
Why it's wrong here
Source IP is used but not a primary design factor; it's more about network segments.
- ✗
Destination port
Why it's wrong here
Destination port is typically not used for authentication enforcement.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.