4.4 Explain the Integration of Prisma SD-WAN with Cloud Identity Engine (CIE) SD-WAN-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary role of Cloud Identity Engine (CIE) when integrated with Prisma SD-WAN?

   • ATo provide a VPN tunnel aggregation point for all remote sites
   • BTo provide a cloud-based repository of user and group identity information that can be used for policy enforcement
   • CTo manage the physical SD-WAN appliances and their firmware updates
   • DTo replace the need for a firewall by providing direct security inspection of all traffic
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Prisma SD-WAN administrator is troubleshooting an identity-based policy issue. The CIE portal shows the identity source is 'Connected' and the sync agent is running. In Prisma SD-WAN, the integration is enabled and the identity source is mapped. However, users in the 'Finance' group are not being matched by the policy. The administrator has verified that the policy is correctly configured with the 'Finance' group in the source. What is the most likely cause of this issue?

   • AThe branch firewall is not configured to use CIE for user authentication.
   • BThe policy is applied to the wrong branch firewall interface.
   • CThe Finance group is not a security group in Active Directory.
   • DThe sync agent has not completed an initial full synchronization of the Finance group from Active Directory.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What must be configured in Cloud Identity Engine before it can be integrated with Prisma SD-WAN?

   • AA VPN tunnel between CIE and Prisma SD-WAN
   • BA dedicated administrator account for each user in the organization
   • CA firewall policy that allows all traffic from Prisma SD-WAN
   • DA directory synchronization source, such as an LDAP or Active Directory connector
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has integrated Prisma SD-WAN with Cloud Identity Engine. They want to enforce a policy that blocks access to social media for all users except those in the 'Marketing' group. The administrator creates a security policy rule with the 'Marketing' group in the source. What else must be configured for this policy to work as intended?

   • AThe 'Marketing' group must be configured as the default user group in Prisma SD-WAN.
   • BThe policy must be applied to the branch firewall's external interface only.
   • CA separate deny rule for all other users that is placed before the allow rule for the Marketing group.
   • DThe 'Marketing' group must be added to the destination field of the policy.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is using Prisma SD-WAN and wants to enforce different internet access policies for contractors and full-time employees. They have a contractor management system that is not integrated with Active Directory. The administrator wants to use identity-based policies without managing local accounts. What is the best approach?

   • AUse IP-based policies to differentiate contractors from employees.
   • BCreate local user accounts for contractors on each branch firewall.
   • CRequire contractors to use a separate VPN that bypasses Prisma SD-WAN policies.
   • DIntegrate the contractor management system with Cloud Identity Engine as an additional identity source.
   Reveal Solution Discussion Select an answer first