1.7 Configure and Implement Identity Authentication Within Prisma Access SECURITY-SERVICE-EDGE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is deploying Prisma Access and wants to use LDAP authentication against their on-premises Active Directory. The security team is concerned about the availability of the on-premises directory and wants to ensure that authentication continues to work if the directory becomes unreachable. The administrator needs to balance availability with security. Which approach should the administrator take?

   • AConfigure Kerberos authentication as a fallback when the directory is unreachable.
   • BConfigure SAML authentication with a cloud-based identity provider as a fallback.
   • CConfigure a local user database in Prisma Access as a fallback when the directory is unreachable.
   • DConfigure LDAP authentication with multiple directory servers and enable failover in Prisma Access.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company with 5,000 users in Active Directory is deploying Prisma Access for remote workers. The security team wants to enforce identity-based policies that reflect group memberships, but they do not want to maintain a separate user database in Prisma Access. They also need to support users who authenticate with both SAML-based SSO and legacy VPN clients that use LDAP. Which approach should the administrator take?

   • ACreate local users in Prisma Access and manually assign group memberships to match Active Directory groups for policy enforcement.
   • BDeploy a separate RADIUS server that proxies authentication to Active Directory and configure Prisma Access to use RADIUS for all authentication.
   • CConfigure Cloud Identity Engine to connect to Active Directory and use it as the single identity source for both SAML and LDAP authentication flows.
   • DUse SAML authentication only and disable LDAP-based VPN clients, requiring all users to migrate to the SSO portal.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization is implementing SAML authentication for Prisma Access using Azure AD as the identity provider. The administrator has configured the SAML SSO profile and uploaded the Azure AD metadata. Users can authenticate successfully, but the security team notices that group-based policies are not being applied correctly. The administrator has verified that the SAML assertion includes group claims. What is the most likely cause of the issue?

   • AThe Prisma Access gateway is not configured to use the SAML profile for authentication.
   • BThe users are not assigned to the SAML application in Azure AD.
   • CThe SAML assertion does not include the user's email address.
   • DThe group claims in the SAML assertion are not mapped to the correct identity source groups in Cloud Identity Engine.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary function of LDAP authentication in Prisma Access?

   • ATo synchronize user groups from the directory to Cloud Identity Engine
   • BTo provide single sign-on across multiple applications
   • CTo authenticate users by checking credentials against a directory server
   • DTo encrypt the user's credentials during transmission
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary role of Cloud Identity Engine in a Prisma Access deployment?

   • ATo provide a centralized service that connects identity sources to Prisma Access and supplies identity information for policy enforcement
   • BTo act as a firewall between the user and the internet, inspecting all traffic for malware
   • CTo replace the need for any external identity provider by storing all user credentials directly in Prisma Access
   • DTo provide a VPN gateway that terminates remote access tunnels for Prisma Access users
   Reveal Solution Discussion Select an answer first