2.6 Configure On-Premises and Cloud Identity Engine User-ID NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which policy type can reference user or group attributes for access control?

   • AQoS policy
   • BDecryption policy
   • CNAT policy
   • DSecurity policy
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which component can be used to synchronize users and groups from an on-premises directory to the Cloud Identity Engine?

   • AGlobalProtect gateway
   • BDirectory Sync agent
   • CCaptive portal
   • DUser-ID agent
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of User-ID segments?

   • ATo redistribute mappings
   • BTo synchronize directories
   • CTo map users to IP addresses
   • DTo control which users and groups are visible in different network zones or contexts
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses a non-Microsoft LDAP directory (OpenLDAP) for user authentication. The firewall needs to enforce a policy that allows only members of the 'Engineering' group to access a specific application. The directory sync is already configured and working. What additional configuration is required to ensure the firewall can resolve the 'Engineering' group for policy enforcement?

   • ACreate a local user group on the firewall and manually add the members of the 'Engineering' group.
   • BEnable User-ID redistribution to share the group information with other firewalls.
   • CConfigure a group mapping entry that specifies the LDAP server, base DN, and group object class.
   • DConfigure the firewall to use the LDAP server as an authentication profile for the application.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multi-tenant environment uses a single pair of PAN-OS firewalls to serve two distinct business units. Each business unit has its own Active Directory forest and its own set of security policies. The firewall administrator wants to ensure that users from Business Unit A cannot be matched by policies that reference groups from Business Unit B. What should be configured to isolate the user and group information?

   • ACreate two separate User-ID agents, one for each business unit, and configure the firewall to use both.
   • BDefine User-ID segments for each business unit and assign the respective users and groups to each segment.
   • CUse different authentication policies for each business unit to restrict which users can authenticate to the firewall.
   • DConfigure separate group mapping entries for each business unit and ensure the policies reference the correct group names.
   Reveal Solution Discussion Select an answer first