4.4 Explain the Integration of Prisma SD-WAN with Cloud Identity Engine (CIE) SD-WAN-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An organization is integrating Prisma SD-WAN with Cloud Identity Engine. They have two identity sources: on-premises Active Directory and Azure AD. The administrator wants to use groups from both sources in Prisma SD-WAN policies. During configuration, they notice that groups from Azure AD are visible in CIE, but groups from Active Directory are not. The sync agent is running and shows no errors. What is the most likely cause of this issue?

   • AThe Azure AD identity source is overriding the Active Directory source.
   • BThe sync agent is only configured to synchronize Azure AD.
   • CThe Active Directory domain controllers are not reachable from the CIE cloud.
   • DThe Active Directory identity source has not been mapped to the Prisma SD-WAN tenant in CIE.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A regional bank is deploying Prisma SD-WAN across 40 branch offices. The security team wants to enforce different internet access policies for employees in the Finance group versus the HR group, but they do not want to create separate policies per branch or manage local user accounts on each branch firewall. They already synchronize user and group data from Active Directory to the cloud. What should the administrator configure to meet this requirement?

   • AUse Prisma SD-WAN's built-in user database to create Finance and HR groups and assign users to them at each branch.
   • BConfigure the branch firewalls to authenticate users against the local Active Directory directly using LDAP.
   • CIntegrate Prisma SD-WAN with Cloud Identity Engine and create identity-based security policies referencing the Finance and HR groups.
   • DCreate separate security policies on each branch firewall and manually add the Finance and HR user lists to each site.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Prisma SD-WAN administrator is troubleshooting an issue where identity-based policies are not being enforced. The CIE portal shows the identity source is 'Connected' and the sync agent is running. In Prisma SD-WAN, the integration is enabled. What should the administrator check next?

   • AEnsure that the Active Directory domain controllers are reachable from the Prisma SD-WAN branch firewalls.
   • BVerify that the identity source is mapped to the Prisma SD-WAN tenant in CIE.
   • CConfirm that the users are logging in via the Prisma SD-WAN captive portal.
   • DCheck if the branch firewalls have internet connectivity to the CIE cloud.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization is planning to integrate Prisma SD-WAN with Cloud Identity Engine. They have a complex Active Directory environment with multiple domains in a single forest. The administrator wants to ensure that all users and groups from all domains are available for policy enforcement. What is a prerequisite for this integration?

   • AThe Directory Sync Agent must be installed on a server that can reach all domain controllers in the forest.
   • BA separate Cloud Identity Engine tenant must be created for each domain.
   • CThe Prisma SD-WAN branch firewalls must be joined to the Active Directory domain.
   • DThe Active Directory forest must be migrated to Azure AD before integration.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company wants to integrate Prisma SD-WAN with Cloud Identity Engine. Their identity source is an on-premises Active Directory forest. The administrator has already created a CIE tenant and added the Active Directory as an identity source. What is the next required step to complete the integration?

   • AEnable the CIE integration toggle in Prisma SD-WAN and wait for automatic discovery of the Active Directory.
   • BCreate a new identity source in Prisma SD-WAN and point it to the Active Directory server.
   • CConfigure the Prisma SD-WAN branch firewalls to query Active Directory directly for user authentication.
   • DInstall and configure the Cloud Identity Engine Directory Sync Agent on a server that can reach the Active Directory domain controllers.
   Reveal Solution Discussion Select an answer first