A small business with 50 employees uses a single Palo Alto Networks firewall. They have no existing directory service and want the simplest method to identify users for policy enforcement. Users should be able to log in with a username and password when their traffic triggers a policy. What should the architect recommend?

Configure a local user database on the firewall with captive portal authentication

Set up SAML with a cloud identity provider

Deploy a RADIUS server and configure RADIUS authentication

Use client certificate authentication for all users

An organization wants to enable single sign-on for firewall administrators using their existing Okta tenant. They have 200 administrators who currently use individual local accounts on each firewall. The architect needs to reduce administrative overhead while maintaining MFA enforcement. Which authentication method should be configured?

Local authentication with a shared administrative account

LDAP authentication against Okta's directory

Cloud Authentication Service (CAS) with SAML against Okta

RADIUS authentication pointing directly to Okta

A company has a hybrid environment with users in on-premises Active Directory and a cloud-based workforce using Azure AD. They need to enforce user-based firewall policies for both groups. The architect wants to avoid deploying additional software on endpoints. Which user identification approach should be used?

X-Forwarded-For header inspection on the firewall

User-ID agent on each domain controller for on-premises users and Cloud Identity Engine for cloud users

Captive portal with local database authentication

Terminal Services agent on all servers

What is the primary role of the Cloud Identity Engine (CIE) in a Palo Alto Networks environment?

To replace the need for authentication servers

To provide a cloud-based firewall management interface

To centralize user identity management and enable consistent user identification across the network

To provide a VPN service for remote users

Palo Alto NetworksCertified Network Security Architect

Domain 3Objective 5

3.5 Recommend User Identification and Authentication Methods (e.g., Cloud Identity Engine, CAS for SAML) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the Centralized Management and IAM domain, which accounts for 13% of the NETWORK-SECURITY-ARCHITECT exam.

25questions here

5free pages

5concepts

13%of the exam

Questions 11–15

11application · medium
A small business with 50 employees uses a single Palo Alto Networks firewall. They have no existing directory service and want the simplest method to identify users for policy enforcement. Users should be able to log in with a username and password when their traffic triggers a policy. What should the architect recommend?
Select an answer first
12application · medium
An organization wants to enable single sign-on for firewall administrators using their existing Okta tenant. They have 200 administrators who currently use individual local accounts on each firewall. The architect needs to reduce administrative overhead while maintaining MFA enforcement. Which authentication method should be configured?
Select an answer first
13application · medium
A company has a hybrid environment with users in on-premises Active Directory and a cloud-based workforce using Azure AD. They need to enforce user-based firewall policies for both groups. The architect wants to avoid deploying additional software on endpoints. Which user identification approach should be used?
Select an answer first
14foundation · easy
What is the primary role of the Cloud Identity Engine (CIE) in a Palo Alto Networks environment?
Select an answer first
15foundation · easy
Which protocol does the Cloud Authentication Service (CAS) use to enable single sign-on for Palo Alto Networks products?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.

3.5 Recommend User Identification and Authentication Methods (e.g., Cloud Identity Engine, CAS for SAML) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

What is the primary role of the Cloud Identity Engine (CIE) in a Palo Alto Networks environment?

Which protocol does the Cloud Authentication Service (CAS) use to enable single sign-on for Palo Alto Networks products?

Keep studying — Centralized Management and IAM