PCNSE · Question #49
Which command can be used to validate a Captive Portal policy?
The correct answer is C. test authentication-policy-match <criteria>. The test authentication-policy-match command is used to simulate user traffic against defined authentication policies, including Captive Portal, to validate their configuration and expected behavior.
Question
Which command can be used to validate a Captive Portal policy?
Options
- Aeval captive-portal policy <criteria>
- Brequest cp-policy-eval <criteria>
- Ctest authentication-policy-match <criteria>
- Ddebug cp-policy <criteria>
How the community answered
(27 responses)- B4% (1)
- C93% (25)
- D4% (1)
Why each option
The `test authentication-policy-match` command is used to simulate user traffic against defined authentication policies, including Captive Portal, to validate their configuration and expected behavior.
`eval captive-portal policy` is not a standard operational command in PAN-OS for policy validation.
`request cp-policy-eval` is not a standard operational command in PAN-OS for policy validation.
The `test authentication-policy-match <criteria>` command is the correct operational command on Palo Alto Networks firewalls to simulate a session with specified source, destination, and other parameters, and verify how it matches against all configured authentication policies, which include Captive Portal rules. This allows an administrator to validate policy logic without generating live traffic.
`debug cp-policy` is not a standard operational command for policy matching validation; `debug` commands are generally used for deeper troubleshooting and might not offer direct policy match simulation.
Concept tested: Validating authentication policy matches
Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication/authentication-policy/test-an-authentication-policy
Topics
Community Discussion
No community discussion yet for this question.