An administrator needs to update the service account password for the on-premises agent used by Cloud Identity Engine. What is the correct procedure to ensure the agent continues to sync without interruption?

Change the password in Active Directory only; the agent will automatically detect the new password.

Update the service account password in Active Directory, then update the credentials in the agent configuration and restart the agent service.

Reinstall the agent with a new service account, then delete the old agent from Cloud Identity Engine.

Update the password in Cloud Identity Engine portal only; the agent will sync the change.

An organization has standardized on Okta as its identity provider and does not maintain an on-premises Active Directory. They want to use Cloud Identity Engine to map users to groups for firewall policy enforcement. The architect must enable directory sync. What should the architect do?

Configure SAML 2.0 between Okta and Cloud Identity Engine to synchronize all users and groups.

Use the Microsoft Entra ID integration and point it to Okta's tenant ID.

Deploy the on-premises agent and configure it to connect to Okta via LDAP Interface.

Create an API token in Okta with read-only access to users and groups, then add Okta as a cloud directory in Cloud Identity Engine using that token.

When would you recommend using the on-premises agent for directory sync instead of a cloud directory integration?

When the organization wants to avoid any outbound connectivity to the cloud

When the organization uses Microsoft Entra ID as its identity provider

When the organization uses Okta as its identity provider

When the directory source is located on-premises, such as Active Directory

An organization uses a third-party identity provider that supports SAML 2.0 but does not offer a native Cloud Identity Engine integration. The architect wants to enable user-ID-based policies on the firewalls. What is the recommended approach?

Use the SAML 2.0 support in Cloud Identity Engine to configure the identity provider as an authentication source, and rely on the SAML assertion to provide user identity.

Deploy the on-premises agent and configure it to connect to the third-party IdP via LDAP.

Use the Microsoft Entra ID integration and configure it to proxy to the third-party IdP.

Export users from the IdP and import them into Cloud Identity Engine as a static CSV directory.

A company has deployed the on-premises agent for Cloud Identity Engine. The agent is running, but the Cloud Identity Engine portal shows that the directory sync has not completed. The administrator checks the agent logs and sees an error indicating that the service account cannot access the directory. What is the most likely cause?

The service account does not have the required read permissions on the Active Directory organizational units or attributes being synced.

The agent is installed on a server that does not have internet connectivity.

The agent is using the wrong port for LDAP communication.

The agent is configured to use LDAPS, but the domain controller does not have a valid certificate.

Palo Alto NetworksCertified Network Security Architect

Domain 3Objective 3

3.3 Recommend Cloud Identity Engine Directory Sync Options NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Part of the Centralized Management and IAM domain, which accounts for 13% of the NETWORK-SECURITY-ARCHITECT exam.

31questions here

7free pages

8concepts

13%of the exam

Questions 16–20

16application · medium
An administrator needs to update the service account password for the on-premises agent used by Cloud Identity Engine. What is the correct procedure to ensure the agent continues to sync without interruption?
Select an answer first
17application · medium
An organization has standardized on Okta as its identity provider and does not maintain an on-premises Active Directory. They want to use Cloud Identity Engine to map users to groups for firewall policy enforcement. The architect must enable directory sync. What should the architect do?
Select an answer first
18foundation · easy
When would you recommend using the on-premises agent for directory sync instead of a cloud directory integration?
Select an answer first
19application · medium
An organization uses a third-party identity provider that supports SAML 2.0 but does not offer a native Cloud Identity Engine integration. The architect wants to enable user-ID-based policies on the firewalls. What is the recommended approach?
Select an answer first
20expert · hard
A company has deployed the on-premises agent for Cloud Identity Engine. The agent is running, but the Cloud Identity Engine portal shows that the directory sync has not completed. The administrator checks the agent logs and sees an error indicating that the service account cannot access the directory. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.