NGFW-ENGINEER practice question 10 of 10

An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication…

An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML. Which two actions meet the criteria? (Choose two.)

Answer options

A: Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem. Correct answer

B: Create an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.

C: Create and apply an authentication profile with the “SAML Identity Provider” Server Profile. Correct answer

D: Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.

Correct Answer:

A. Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.; C. Create and apply an authentication profile with the “SAML Identity Provider” Server Profile.

Explanation

In PAN-OS, an Authentication Sequence allows multiple authentication profiles to be evaluated sequentially, providing a fallback mechanism if the primary server is unreachable. However, SAML authentication relies on HTTP redirects to an external Identity Provider (IdP) for user credential verification. This redirection fundamentally conflicts with the firewall-managed sequential fallback process. Consequently, Palo Alto Networks explicitly prohibits adding a SAML-based authentication profile to an Authentication Sequence. Because SAML and RADIUS cannot be combined in a sequence to run in tandem for a single login prompt, engineers must create a dedicated SAML authentication profile to facilitate the new method. Furthermore, they must develop a testing and rollback plan to migrate administrators systematically, acknowledging that tandem fallback operation between RADIUS and SAML is technically unsupported.

Why Incorrect

Option B: PAN-OS explicitly restricts SAML authentication profiles from being added to an Authentication Sequence because SAML requires external IdP redirection, breaking the sequential fallback mechanism.
Option D: An Authentication Profile in PAN-OS strictly supports a one-to-one mapping with a Server Profile; you cannot assign both SAML and RADIUS server profiles to a single authentication profile.

References

1. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator’s Guide. "Authentication Sequences." (Explicitly states: "You cannot add an authentication profile that uses SAML authentication to an authentication sequence.")

2. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator’s Guide. "Configure SAML Authentication." (Details the requirement to create a SAML Identity Provider Server Profile and apply it to a dedicated Authentication Profile).

3. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator’s Guide. "Authentication Profiles." (Documents the architectural constraint that an Authentication Profile maps to exactly one Server Profile type).

Keep practicing

Take the free NGFW-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test