An organization has two RADIUS servers for redundancy. They want the firewall to try the first RADIUS server, and if it is unreachable, try the second RADIUS server. Both servers use the same authentication profile settings. What is the most efficient way to configure this?

Create a single RADIUS profile and configure the second server as the 'backup' in the profile settings.

Create a single RADIUS profile and list both server addresses in the 'Server' field.

Create one RADIUS profile and assign it to two different admin accounts, each with a different server.

Create two RADIUS authentication profiles (one per server) and add both to an authentication sequence in the desired order.

What is a common method to test an authentication sequence?

Temporarily disable the primary authentication server and attempt login

Change the administrator's role to superuser

A company is migrating from local admin accounts to centralized authentication via SAML. The SAML IdP has been configured, and the firewall can reach it. What is the next step to enable SAML authentication for administrators?

Create a RADIUS profile and point it to the SAML IdP's IP address.

Configure the firewall as a SAML IdP and create local user accounts for each administrator.

Create a SAML authentication profile in PAN-OS with the IdP metadata, then assign the profile to the admin accounts.

Assign the SAML IdP as the authentication server in the existing LDAP profile.

How can you verify that an authentication role is correctly implemented?

By checking the local user database

By checking the authentication profile settings

By reviewing the authentication sequence order

By logging in as an administrator and testing the assigned permissions

When configuring an authentication sequence, what determines the order in which profiles are attempted?

The authentication method type (e.g., LDAP before RADIUS)

The alphabetical order of the profile names

The order in which profiles are added to the sequence

The server response time of each profile

Palo Alto NetworksCertified Next-Generation Firewall Engineer

Domain 2Objective 1

2.1 Implement Authentication Roles, Profiles, and Sequences NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 5)

Part of the PAN-OS Device Setting Configuration domain, which accounts for 40% of the NEXT-GENERATION-FIREWALL-ENGINEER exam.

31questions here

7free pages

10concepts

40%of the exam

Questions 21–25

21application · medium
An organization has two RADIUS servers for redundancy. They want the firewall to try the first RADIUS server, and if it is unreachable, try the second RADIUS server. Both servers use the same authentication profile settings. What is the most efficient way to configure this?
Select an answer first
22foundation · medium
What is a common method to test an authentication sequence?
Select an answer first
23application · medium
A company is migrating from local admin accounts to centralized authentication via SAML. The SAML IdP has been configured, and the firewall can reach it. What is the next step to enable SAML authentication for administrators?
Select an answer first
24foundation · medium
How can you verify that an authentication role is correctly implemented?
Select an answer first
25foundation · medium
When configuring an authentication sequence, what determines the order in which profiles are attempted?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NEXT-GENERATION-FIREWALL-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NEXT-GENERATION-FIREWALL-ENGINEER” is a trademark of its owner, used for identification only.