Which PAN-OS?policy must you configure to force a user to provide additional credentials before he is allowed to access an internal application that contains highly-sensitive business data?

Question

Options

• ASecurity policy
• BDecryption policy
• CAuthentication policy
• DApplication Override policy

• A
  3% (1)
• C
  93% (28)
• D
  3% (1)

Explanation

Authentication policy in PAN-OS is specifically designed to enforce multi-factor or step-up authentication at the point of access - it intercepts traffic and prompts users for additional credentials before allowing them through, making it the right tool for protecting highly-sensitive applications.

• A (Security policy) controls whether traffic is allowed or denied based on zones, addresses, and applications, but it cannot challenge users for additional credentials mid-session.
• B (Decryption policy) determines whether SSL/TLS traffic is decrypted for inspection - it has nothing to do with user authentication challenges.
• D (Application Override policy) bypasses App-ID processing to manually classify traffic, which improves performance but removes security enforcement entirely - the opposite of what you want here.

Memory tip: Think "Authentication policy = Authentication challenge." If the goal is to ask the user to prove who they are again, the word "Authentication" in the policy name is your clue. Any other policy type acts on traffic or content, not on the user's identity.

No community discussion yet for this question.