A hospital network has a strict compliance requirement that all user authentication for firewall admin access must use multi-factor authentication. They currently have a legacy RADIUS server that supports only PAP and does not support MFA. The architect must implement MFA without replacing the entire RADIUS infrastructure. What should be recommended?

Deploy a RADIUS proxy that adds MFA in front of the legacy RADIUS server

Switch to local authentication with a strong password policy

Implement SAML with a new identity provider that supports MFA

Configure the firewall to use the legacy RADIUS server directly

A company is migrating from on-premises Active Directory to a cloud-only identity model using Okta. They have 20 firewalls that need to continue enforcing user-based policies. The architect wants to avoid maintaining on-premises User-ID agents. What should be recommended?

Integrate Cloud Identity Engine with Okta and connect all firewalls to CIE

Use SAML authentication via CAS for all user traffic

Configure firewalls with LDAP profiles pointing to Okta

Keep User-ID agents running against a read-only domain controller

A university campus uses 802.1X with certificates for wireless access. They want to enforce user-based policies on the firewall based on the same certificate identities. What user identification method should the architect configure?

User-ID agent with terminal services monitoring

Captive portal with username/password

RADIUS authentication with the existing RADIUS server

Certificate-based user identification on the firewall

A multinational company is deploying Palo Alto Networks firewalls in 12 regions. They need to enforce consistent user-based policies across all firewalls, but each region currently maintains its own Active Directory forest with different domain names. The security team wants a single source of truth for user identity that all firewalls can query without maintaining multiple LDAP server profiles. What should the architect recommend?

Deploy Cloud Identity Engine to connect to all Active Directory forests and distribute identity information to all firewalls

Use local firewall user databases replicated via Panorama templates

Implement SAML authentication with a single identity provider for firewall admin access

Configure each firewall with a separate LDAP server profile pointing to its local domain controller

When recommending a user authentication method, which factor is most important to consider for an organization that requires high scalability and centralized management?

The number of firewalls in the network

The ability to integrate with existing identity infrastructure

The physical location of the data center

Palo Alto NetworksCertified Network Security Architect

Domain 3Objective 5

3.5 Recommend User Identification and Authentication Methods (e.g., Cloud Identity Engine, CAS for SAML) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Part of the Centralized Management and IAM domain, which accounts for 13% of the NETWORK-SECURITY-ARCHITECT exam.

25questions here

5free pages

5concepts

13%of the exam

Questions 1–5

1expert · hard
A hospital network has a strict compliance requirement that all user authentication for firewall admin access must use multi-factor authentication. They currently have a legacy RADIUS server that supports only PAP and does not support MFA. The architect must implement MFA without replacing the entire RADIUS infrastructure. What should be recommended?
Select an answer first
2application · medium
A company is migrating from on-premises Active Directory to a cloud-only identity model using Okta. They have 20 firewalls that need to continue enforcing user-based policies. The architect wants to avoid maintaining on-premises User-ID agents. What should be recommended?
Select an answer first
3application · medium
A university campus uses 802.1X with certificates for wireless access. They want to enforce user-based policies on the firewall based on the same certificate identities. What user identification method should the architect configure?
Select an answer first
4application · medium
A multinational company is deploying Palo Alto Networks firewalls in 12 regions. They need to enforce consistent user-based policies across all firewalls, but each region currently maintains its own Active Directory forest with different domain names. The security team wants a single source of truth for user identity that all firewalls can query without maintaining multiple LDAP server profiles. What should the architect recommend?
Select an answer first
5foundation · easy
When recommending a user authentication method, which factor is most important to consider for an organization that requires high scalability and centralized management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.

3.5 Recommend User Identification and Authentication Methods (e.g., Cloud Identity Engine, CAS for SAML) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

A company is migrating from on-premises Active Directory to a cloud-only identity model using Okta. They have 20 firewalls that need to continue enforcing user-based policies. The architect wants to avoid maintaining on-premises User-ID agents. What should be recommended?

A university campus uses 802.1X with certificates for wireless access. They want to enforce user-based policies on the firewall based on the same certificate identities. What user identification method should the architect configure?

When recommending a user authentication method, which factor is most important to consider for an organization that requires high scalability and centralized management?

Keep studying — Centralized Management and IAM