Palo Alto NetworksCertified Next-Generation Firewall Engineer
Domain 2Objective 6
2.6 Configure On-Premises and Cloud Identity Engine User-ID NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 3)
Part of the PAN-OS Device Setting Configuration domain, which accounts for 40% of the NEXT-GENERATION-FIREWALL-ENGINEER exam.
20questions here
4free pages
6concepts
40%of the exam
Questions 11–15
- 11
In a security policy, what does using user context allow the administrator to enforce?
Select an answer first - 12
A company has a Windows Active Directory environment where users authenticate to a legacy on-premises application that does not support Kerberos or any agent-based integration. The firewall must enforce a policy that blocks access to a sensitive server for all users except the 'Finance' AD group. The network team wants to avoid installing software on end-user workstations. Which User-ID method should be configured to map users to IP addresses in this environment?
Select an answer first - 13
A company has a PAN-OS firewall that is configured to use a User-ID agent for user mapping. The agent is configured to monitor a syslog server that receives authentication events from multiple applications. The administrator notices that some user-to-IP mappings are incorrect, showing users logged in from IP addresses they have never used. The syslog server is receiving events from both the corporate network and a remote office. What is the most likely cause of the incorrect mappings?
Select an answer first - 14
A company has a security policy that allows access to a financial application only for users in the 'Finance' AD group. The User-ID agent is configured and working. However, the administrator finds that some users in the 'Finance' group are being denied access. The administrator checks the user-to-IP mappings and sees that the users are mapped correctly. What is the most likely cause of the issue?
Select an answer first - 15
Which User-ID method uses a software component installed on a server to collect user-to-IP mappings?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NEXT-GENERATION-FIREWALL-ENGINEER” is a trademark of its owner, used for identification only.