3.6 Evaluate Cloud Identity Engine Use Cases NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A global company is rolling out a new zero-trust initiative. They have 2,000 remote employees who connect through Prisma Access, and they also have 500 on-premises users behind NGFWs. The company uses Okta as its identity provider and wants to enforce the same user-based application access policies for both remote and on-premises users. The security team wants to avoid maintaining separate user-to-IP mapping tables. Which approach should the architect take to meet these requirements?

   • ADeploy a secondary RADIUS server to authenticate all users and configure both NGFW and Prisma Access to query it for user identity.
   • BDeploy Cloud Identity Engine, integrate it with Okta, and configure the NGFWs and Prisma Access to use Cloud Identity Engine as the identity source for user-ID mapping.
   • CUse GlobalProtect to collect user credentials on the NGFW and Prisma Access, and manually create static user-to-IP mappings for all remote users.
   • DConfigure each NGFW to use its local LDAP server for user mapping, and configure Prisma Access to use a separate Okta integration for remote users.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has 5,000 remote users who connect via Prisma Access. They use Microsoft Entra ID (Azure AD) as their identity provider. The security team wants to enforce different access policies for contractors versus full-time employees, and they need to see which user is associated with each connection in the firewall logs. They also want to avoid deploying any additional on-premises infrastructure. What should the architect configure?

   • AConfigure Prisma Access to authenticate users directly against Microsoft Entra ID using SAML and rely on the authentication logs for user identification.
   • BDeploy a GlobalProtect gateway on-premises and configure it to forward user mappings to Prisma Access.
   • CUse the Prisma Access built-in user database and manually create user accounts for all 5,000 remote users.
   • DIntegrate Cloud Identity Engine with Microsoft Entra ID and configure Prisma Access to use Cloud Identity Engine for user identification.
   Reveal Solution Discussion Select an answer first
4. 8application · medium · select all that apply

   A company has NGFWs in their data center and branch offices connected via Prisma SD-WAN. They use Microsoft Entra ID as their identity provider. The security team wants to enforce user-based policies for both data center traffic and branch traffic. They also want to ensure that user group changes in Entra ID are reflected in policy enforcement quickly. Which of the following are benefits of using Cloud Identity Engine in this scenario? (Select all that apply.)

   • AAutomatically creates user accounts in the NGFW and Prisma SD-WAN local databases.
   • BProvides a single integration point with Microsoft Entra ID for both NGFWs and Prisma SD-WAN.
   • CProvides real-time user authentication for every connection.
   • DEliminates the need for any on-premises infrastructure for identity management.
   • EDistributes user and group mappings to both NGFWs and Prisma SD-WAN for consistent policy enforcement.
   Check answers Discussion Select an answer first
5. 9application · medium

   An organization uses NGFWs in a data center and Prisma Access for remote users. They have recently migrated from Active Directory on-premises to Microsoft Entra ID (cloud-only). The security team wants to enforce user-based policies for both data center traffic and remote user traffic. They also want to reduce the administrative overhead of managing user mappings. What should the architect implement?

   • AConfigure the NGFWs to use LDAP to connect to Microsoft Entra ID and configure Prisma Access to use SAML for user identification.
   • BDeploy a domain controller in Azure and configure both NGFWs and Prisma Access to use it for user mapping.
   • CUse GlobalProtect to collect user credentials and manually map users to IP addresses on each NGFW and Prisma Access.
   • DIntegrate Cloud Identity Engine with Microsoft Entra ID and configure both the NGFWs and Prisma Access to use it as the identity source.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does Cloud Identity Engine support policy enforcement in a Prisma SD-WAN branch network?

   • ABy providing user and group information that can be used in SD-WAN security policies
   • BBy performing deep packet inspection on all branch traffic
   • CBy providing a cloud-based firewall for each branch
   • DBy managing the routing protocols between branch sites
   Reveal Solution Discussion Select an answer first