2.1 Implement Authentication Roles, Profiles, and Sequences NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · medium

   What is the local authentication method in PAN-OS?

   • AAuthenticating against an external LDAP server
   • BAuthenticating against the firewall's built-in user database
   • CAuthenticating via SAML single sign-on
   • DAuthenticating using a RADIUS server
   Reveal Solution Discussion Select an answer first
2. 17foundation · medium

   What is the function of an authentication profile in PAN-OS?

   • AIt defines the permissions an administrator has after login
   • BIt determines the order in which authentication servers are tried
   • CIt stores user credentials locally on the firewall
   • DIt specifies the authentication method and associated settings for administrative users
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   When would you choose local authentication for administrative users?

   • AWhen you want to centralize user management across multiple firewalls
   • BWhen you have a small number of administrators and no external authentication server
   • CWhen you need to integrate with an existing corporate directory
   • DWhen you need to enforce multi-factor authentication
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   Which of the following is an external authentication server that can be integrated into a PAN-OS authentication profile?

   • ALDAP
   • BLocal database
   • CTACACS+
   • DKerberos
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has a team of three network engineers who need to manage firewall policies but must NOT be able to modify device settings or view the admin password hash. The firewall is integrated with the corporate Active Directory. You need to grant these engineers the minimum necessary access. What should you configure?

   • AAssign the built-in 'superuser' role to the engineers and restrict their access by placing them in a separate administrative domain.
   • BCreate a local user account for each engineer with the 'policy' read-write role and disable their LDAP accounts.
   • CConfigure a RADIUS authentication profile and assign the 'auditor' role to the RADIUS group.
   • DCreate a custom authentication role with only the 'policy' read-write permission and assign it to the engineers via an authentication profile using LDAP group mapping.
   Reveal Solution Discussion Select an answer first