An enterprise Information Security team has deployed policies based on AD groups to restrict user access to critical infrastructure systems. However…

To implement the native PAN-OS MFA integration, an administrator configures a single Authentication Profile. Within this profile, a primary authentication method (like LDAP for the AD password) is set up. Then, a second factor is added by referencing a configured MFA Server Profile (e.g., for Duo, Okta, PingID, or RADIUS). This consolidated Authentication Profile, containing both factors, is then applied to an Authentication Policy rule. When a user's traffic matches this rule, Captive Portal is triggered, which enforces the multi-step authentication defined in the profile. This method directly utilizes the firewall's built-in MFA vendor integrations.

A: An Authentication Sequence chains separate profiles. While it can achieve MFA, it is a more generic method, not the specific "MFA integration" feature described in option C. B: This describes single-factor authentication using a RADIUS server. It does not fulfill the multi-factor requirement. D: Credential Phishing Prevention is a separate security feature that prevents users from submitting corporate credentials to untrusted websites; it does not enforce MFA for internal resource access.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: "Configure Multi-Factor Authentication." This section details the primary method for MFA: "You configure MFA by adding one or more MFA vendor configurations to an authentication profile... When you apply the authentication profile to a policy, the firewall requires users to pass authentication for the primary authentication vendor and for each MFA vendor."

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: "Authentication Policy." This section explains how Authentication Policy rules are used to enforce authentication, stating, "An Authentication policy rule enforces an Authentication Profile... on traffic that matches the rule criteria."

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: "Authentication Sequence." This source is used to differentiate from option A. It describes an authentication sequence as a way to "chain authentication profiles together," which is a different configuration workflow than the integrated MFA feature.

4. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: "Credential Phishing Prevention." This source is used to differentiate from option D. It describes how the firewall "prevents credential theft by controlling the sites to which users can submit their corporate credentials." This is distinct from access control enforcement.