3.3 Recommend Cloud Identity Engine Directory Sync Options NETWORK-SECURITY-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is migrating from an on-premises Active Directory to a cloud-only Microsoft Entra ID environment. During the transition, both directories will be active for six months. The firewall policies need to recognize users from both directories. The architect must recommend a sync strategy that minimizes disruption. What should the architect recommend?

   • AUse only the Entra ID integration and disable the on-premises agent, since the migration is underway.
   • BUse only the on-premises agent and manually create cloud users in AD.
   • CConfigure SAML 2.0 between AD and Entra ID to merge the two directories.
   • DConfigure both the on-premises agent for AD and the Entra ID integration, and map both directories to the firewall.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which Microsoft API is typically used to sync directory data from Entra ID to Cloud Identity Engine?

   • AWindows Management Instrumentation (WMI)
   • BMicrosoft Graph API
   • CRepresentational State Transfer (REST) API for Active Directory
   • DSimple Network Management Protocol (SNMP)
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary benefit of integrating Cloud Identity Engine with a cloud directory?

   • AIt enables offline access to directory data
   • BIt replaces the need for a firewall
   • CIt allows for identity synchronization without an on-premises agent
   • DIt provides a backup of the cloud directory
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company uses Microsoft Entra ID as its sole identity source for all applications and has no on-premises directory. They are deploying Cloud Identity Engine to provide user-ID to their Palo Alto Networks firewalls. The architect needs to configure directory sync. What is the minimum set of actions required to complete this integration?

   • ADeploy the on-premises agent on a Windows server and configure it to connect to Entra ID using LDAP.
   • BConfigure SAML 2.0 between Cloud Identity Engine and Entra ID, then map the SAML attributes to user groups.
   • CExport all users and groups from Entra ID to a CSV file and import them into Cloud Identity Engine as a static directory.
   • DIn Cloud Identity Engine, select Microsoft Entra ID as the directory, provide the tenant ID and application credentials, and complete the OAuth consent flow.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization uses Okta as its identity provider and has a custom user attribute that indicates the employee's department. The firewall policy needs to use this department attribute to segment access. The architect is configuring the Okta integration in Cloud Identity Engine. What must be done to make the department attribute available for policy mapping?

   • AExport the department attribute to a CSV and import it into Cloud Identity Engine.
   • BEnsure the Okta API token has permission to read the custom attribute, and map the attribute in the Cloud Identity Engine directory configuration.
   • CDeploy the on-premises agent and configure it to read the custom attribute from Okta.
   • DUse SAML 2.0 to pass the department attribute in the authentication assertion.
   Reveal Solution Discussion Select an answer first