Which three multi-factor authentication methods can be used to authenticate access to the firewall? (Choose three.)

Palo Alto Networks firewalls enhance administrative access security by supporting multi-factor authentication (MFA). This is accomplished through native configurations and integrations with external authentication servers. The firewall can be configured to require a user certificate (a "something you have" factor) in addition to a password. It also integrates with external MFA platforms via RADIUS or SAML. These platforms commonly provide authentication using one-time passwords (OTPs) generated by authenticator apps or hardware tokens, and SMS messages containing verification codes. These three methods—SMS, user certificate, and OTP—are all established mechanisms for implementing MFA for firewall administrators.

A. Voice: Voice biometrics are not a natively supported authentication method on the firewall. This would require integration with a third-party Identity Provider via SAML.
B. Fingerprint: Like voice, fingerprint biometrics are not directly processed by the firewall and would depend on an external authentication service, making it an indirect method.

1. Palo Alto Networks Documentation - Configure Multi-Factor Authentication: This document explicitly states

"To configure multi-factor authentication (MFA)

you must integrate the firewall with an MFA server

such as Okta or Duo

or with a generic RADIUS-based solution

such as RSA SecurID." These services are the typical providers for SMS (C) and One-time password (E) methods.

Source: Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Configure Multi-Factor Authentication".

2. Palo Alto Networks Documentation - Certificate-Based Administrator Authentication: This guide details the process for using client certificates for authenticating administrators to the web interface

confirming the validity of User certificate (D) as an authentication factor.

Source: Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Device > Certificate Management > Certificate Profile".

3. Palo Alto Networks Documentation - Authentication Policy: The documentation on Authentication Policy and Authentication Profiles shows how different methods are configured. It details creating RADIUS server profiles (used for OTP and SMS-based systems) and Certificate Profiles (for User certificates).

Source: Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Device > Authentication Profile".