Which of the following is a required step when configuring the on-premises agent for Cloud Identity Engine?

Assigning a public IP address to the agent

Disabling the firewall on the agent server

Configuring a VPN tunnel between the agent and Cloud Identity Engine

Installing the agent on a server that can reach the directory source

Which of the following is an example of a cloud directory that Cloud Identity Engine can integrate with?

Local Active Directory Domain Services

What is the primary role of the on-premises agent in Cloud Identity Engine directory sync?

To host the Cloud Identity Engine service locally

To synchronize directory data from on-premises sources to Cloud Identity Engine

To replace the need for a firewall in the network

To provide a user interface for managing Cloud Identity Engine

A company has Microsoft Entra ID as its identity source. The firewall policy needs to reference a group that is dynamically populated in Entra ID based on user attributes. The architect is configuring the Cloud Identity Engine Entra ID integration. Will the dynamic group be available for policy mapping?

Yes, because Cloud Identity Engine syncs all groups, including dynamic groups, from Entra ID via the Graph API.

Yes, but only if the on-premises agent is also deployed to read the dynamic group membership.

No, because dynamic groups are only available via SAML 2.0 authentication, not via directory sync.

No, because dynamic groups are not returned by the Graph API and must be manually created in Cloud Identity Engine.

How is the on-premises agent typically managed after installation?

By using a third-party configuration management tool exclusively

Through the Cloud Identity Engine portal

By editing a local configuration file on each agent

Palo Alto NetworksCertified Network Security Architect

Domain 3Objective 3

3.3 Recommend Cloud Identity Engine Directory Sync Options NETWORK-SECURITY-ARCHITECT Practice Questions (Page 6)

Part of the Centralized Management and IAM domain, which accounts for 13% of the NETWORK-SECURITY-ARCHITECT exam.

31questions here

7free pages

8concepts

13%of the exam

Questions 26–30

26foundation · easy
Which of the following is a required step when configuring the on-premises agent for Cloud Identity Engine?
Select an answer first
27foundation · easy
Which of the following is an example of a cloud directory that Cloud Identity Engine can integrate with?
Select an answer first
28foundation · easy
What is the primary role of the on-premises agent in Cloud Identity Engine directory sync?
Select an answer first
29application · medium
A company has Microsoft Entra ID as its identity source. The firewall policy needs to reference a group that is dynamically populated in Entra ID based on user attributes. The architect is configuring the Cloud Identity Engine Entra ID integration. Will the dynamic group be available for policy mapping?
Select an answer first
30foundation · easy
How is the on-premises agent typically managed after installation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.