8.4 Evaluate and Design to Device-ID Capabilities NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational company is deploying Device-ID across multiple regions. Each region has its own firewall and DHCP infrastructure. The security team wants to enforce a global policy that allows only corporate-owned devices to access the corporate network. They are concerned about the consistency of device identification across regions. Which design approach would best ensure consistency?

   • AUse a centralized Device-ID server that collects data from all regions and distributes the mapping table to all firewalls.
   • BUse only DHCP logs as the data source to avoid differences in fingerprinting.
   • CConfigure each firewall to use the same data sources and device fingerprinting database.
   • DDeploy a separate Device-ID collector in each region and synchronize the mapping tables via the management plane.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When deploying Device-ID, which design factor is most important for ensuring accurate device identification?

   • AUsing a single data source for all device mapping
   • BPlacing the firewall at the network edge only
   • CEnsuring the firewall can see traffic from all relevant network segments
   • DDisabling User-ID to avoid conflicts
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a Palo Alto Networks environment, what role does Device-ID play in policy enforcement?

   • AIt encrypts all traffic between devices and the firewall
   • BIt authenticates users before they can access the network
   • CIt provides a device-based identity that can be used in security policy rules
   • DIt assigns IP addresses to devices on the network
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network administrator is monitoring Device-ID effectiveness and notices that the number of 'unknown' devices is increasing. The network has recently added a new subnet for guest Wi-Fi. What is the most likely cause of the increase in unknown devices?

   • AThe guest Wi-Fi devices are using static IP addresses.
   • BThe firewall is not configured to receive DHCP logs from the new subnet's DHCP server.
   • CThe guest Wi-Fi devices are not generating traffic, so the firewall cannot fingerprint them.
   • DThe firewall's Device-ID signature database is outdated.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large organization is planning to deploy Device-ID in a data center with multiple virtualized workloads. The workloads are dynamically provisioned and deprovisioned, and IP addresses are frequently reused. The security team wants to ensure that Device-ID mappings are accurate and do not cause policy enforcement issues. Which design consideration is most important?

   • AUse a longer DHCP lease time to reduce the frequency of IP changes.
   • BDisable Device-ID for the data center zone to avoid false positives.
   • CIntegrate Device-ID with the virtualization platform's API to receive VM lifecycle events.
   • DManually update the Device-ID map whenever a VM is created or deleted.
   Reveal Solution Discussion Select an answer first