3.5 Recommend User Identification and Authentication Methods (e.g., Cloud Identity Engine, CAS for SAML) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization has users in multiple Active Directory domains across different forests. They need to enforce user-based policies on firewalls in a DMZ that cannot directly reach the domain controllers. What should the architect recommend to provide user identification?

   • AConfigure LDAP profiles on the DMZ firewalls pointing to the domain controllers
   • BUse Cloud Identity Engine to collect identity from the forests and distribute it to the DMZ firewalls
   • CPlace a User-ID agent in the DMZ to collect identity
   • DUse captive portal with local authentication for DMZ users
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm requires multi-factor authentication for all firewall administrative access. They already have a RADIUS infrastructure connected to their smart card system. The architect needs to integrate this with the firewalls while minimizing new components. What should be recommended?

   • ADeploy Cloud Authentication Service with SAML to a new identity provider
   • BUse local authentication with a complex password policy
   • CConfigure RADIUS authentication on the firewalls pointing to the existing RADIUS server
   • DSet up LDAP authentication against Active Directory
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary function of the Cloud Authentication Service (CAS) for SAML?

   • ATo provide a VPN service for remote users
   • BTo replace the need for identity providers
   • CTo support SAML-based single sign-on for user authentication to Palo Alto Networks products
   • DTo provide a cloud-based firewall management interface
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a requirement to authenticate firewall administrators using SAML SSO, but they also need to support a small group of contractors who do not have accounts in the corporate identity provider. The architect must provide a solution that supports both groups without compromising security. What should be recommended?

   • AUse only local authentication for all administrators
   • BUse CAS for SAML SSO for employees and local accounts for contractors
   • CUse RADIUS for contractors and SAML for employees
   • DCreate contractor accounts in the identity provider
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization wants to use Cloud Authentication Service (CAS) for SAML SSO to their firewalls. They have a requirement that administrators must be able to access the firewall even if the identity provider or CAS is unavailable. What should the architect recommend to maintain availability?

   • ARely solely on CAS for authentication
   • BConfigure the firewall to cache SAML assertions indefinitely
   • CUse RADIUS as the primary and SAML as the fallback
   • DConfigure a fallback authentication method, such as local accounts, for emergency access
   Reveal Solution Discussion Select an answer first