2.1 Implement Authentication Roles, Profiles, and Sequences NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to grant a group of junior administrators the ability to view configuration and monitor traffic, but they must not be able to make any changes. The firewall authenticates admins via SAML. What is the most efficient way to assign the appropriate access?

   • AAssign the built-in 'superuser' role to each user individually in the SAML IdP.
   • BConfigure the authentication sequence to assign the 'read-only' role after a successful SAML login.
   • CCreate a local account for each junior admin and assign the 'auditor' role.
   • DCreate a custom authentication role with read-only permissions and map the SAML group to this role in the authentication profile.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which PAN-OS object is used to assign administrative permissions to a user based on their group membership?

   • AAuthentication profile
   • BAuthentication sequence
   • CLocal user database
   • DAuthentication role
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A firewall administrator needs to configure administrative authentication against the company's LDAP server. The LDAP server uses a non-standard port and requires a bind account to search the directory. Which settings must be configured in the authentication profile?

   • AServer address, port, bind DN, bind password, and base DN for the search.
   • BServer address, port, and the 'Use Local Database' checkbox.
   • CServer address, shared secret, and the authentication protocol (PAP, CHAP, or MSCHAP).
   • DServer address, certificate, and the IdP entity ID.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An administrator is configuring an authentication sequence with three profiles: LDAP, RADIUS, and Local. The requirement is that if LDAP is unavailable, the firewall should try RADIUS, and if RADIUS is also unavailable, it should try Local. What is the correct configuration?

   • ACreate three separate sequences, one for each profile, and assign them all to the admin account.
   • BAdd LDAP, RADIUS, and Local to the sequence in that exact order.
   • CAdd Local, RADIUS, and LDAP to the sequence in that exact order.
   • DAdd LDAP and RADIUS to the sequence, and configure Local as the 'fallback profile' in the sequence settings.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An administrator is configuring a RADIUS authentication profile. The RADIUS server requires a specific timeout value to avoid false failures during peak load. Which setting in the authentication profile controls this behavior?

   • AThe 'Shared Secret' field, which authenticates the firewall to the RADIUS server.
   • BThe 'Timeout' field, which specifies how long the firewall waits for a response from the RADIUS server.
   • CThe 'Server Port' field, which specifies the UDP port for RADIUS communication.
   • DThe 'Retries' field, which specifies how many times the firewall retries the connection.
   Reveal Solution Discussion Select an answer first