3.2 Architect Strata Cloud Manager (SCM), Strata Logging Service, and Cloud Identity Engine NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An enterprise is migrating from Panorama to SCM. They have a complex environment with multiple device groups and templates. Their change management process requires that any change to a device group or template be approved before it is pushed to firewalls. What should the architect configure in SCM to meet this requirement?

   • AUse SCM's approval workflow for configuration changes.
   • BUse RBAC to restrict who can make changes, but this does not provide an approval step.
   • CUse Panorama's commit process and then migrate to SCM.
   • DConfigure SCM to require a second administrator to re-enter the change before it is applied.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary function of the Strata Logging Service (SLS) when integrated with Strata Cloud Manager?

   • ATo manage firewall software updates and patches
   • BTo provide centralized, cloud-based log storage and retention for managed firewalls
   • CTo provide identity-based access control for users accessing the firewall
   • DTo replace the firewall's security policy engine with a cloud-based filtering service
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which method is used in Strata Cloud Manager to control administrative access to the management platform?

   • AUsing Strata Logging Service to filter management logs
   • BAssigning admin roles with specific permissions to users or groups
   • CSetting device group membership to determine who can manage each firewall
   • DConfiguring firewall interfaces to allow or deny management traffic
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security architect is designing a solution where SCM, SLS, and CIE work together. The goal is to provide centralized management, centralized logging, and user-based policy enforcement. Which statement correctly describes how these services interoperate?

   • ASLS manages policies and forwards them to SCM; CIE stores logs for user-based policy enforcement.
   • BSCM and SLS are interchangeable; CIE is optional for user-based policies.
   • CSCM manages policies and forwards logs to SLS; CIE provides identity information that SCM uses to enforce user-based policies.
   • DCIE manages firewalls and policies; SCM provides identity; SLS provides storage for both.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization is integrating Strata Logging Service (SLS) with SCM. They need to ensure that logs from all managed firewalls are forwarded to SLS and that log retention meets a 1-year compliance requirement. What is the most efficient way to configure this?

   • AEnable SLS in SCM and it will automatically collect logs from all firewalls without additional configuration.
   • BConfigure log forwarding individually on each firewall and set retention on each firewall.
   • CConfigure log forwarding to SLS in the device group's log settings and set the retention period in SLS.
   • DUse Panorama to forward logs to SLS, since SCM cannot do this.
   Reveal Solution Discussion Select an answer first