8.4 Evaluate and Design to Device-ID Capabilities NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to use Device-ID to enforce a policy that allows only approved printers to send print jobs to the print server. The printers are on a separate VLAN and use DHCP. The security team has created a Device-ID group for 'Approved Printers'. Which additional configuration is necessary for the policy to work?

   • ACreate a security policy that allows traffic from the printer VLAN to the print server.
   • BInstall a User-ID agent on the print server.
   • CConfigure the printers to use static IP addresses.
   • DEnsure that the firewall is receiving DHCP logs from the printer VLAN's DHCP server.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How can a security policy use Device-ID to enforce access control?

   • ABy matching the source device type in the policy rule
   • BBy requiring a certificate on each device
   • CBy using the device MAC address as the source address
   • DBy blocking all traffic from unknown devices
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company wants to use Device-ID to enforce a policy that allows only authorized IoT devices to communicate with the building management system (BMS). The IoT devices are on a separate VLAN and use static IP addresses. Which data source should the architect use to identify these devices?

   • ADHCP logs
   • BTraffic fingerprinting
   • CUser-ID agent
   • DActive Directory
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of Device-ID in a Palo Alto Networks security architecture?

   • ATo provide a secure tunnel for device-to-device communication
   • BTo identify and classify devices on the network so security policies can be applied based on device type
   • CTo replace user identification with a device-based authentication method
   • DTo block all unknown devices from accessing the network
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to restrict access to a sensitive server so that only approved IoT devices can connect. They have created a Device-ID group for 'Approved IoT Devices' and a security policy that allows access to the server from this group. However, they find that the policy is not working as expected. What should the architect check first?

   • AVerify that the Device-ID group contains the correct devices and that the devices are being identified correctly.
   • BEnsure that the firewall is receiving DHCP logs from the IoT devices' subnet.
   • CConfirm that the server is in the correct zone.
   • DCheck the order of the security policy in the rulebase.
   Reveal Solution Discussion Select an answer first