1.7 Configure and Implement Identity Authentication Within Prisma Access SECURITY-SERVICE-EDGE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step when configuring Cloud Identity Engine to connect an identity source?

   • AAdd the identity source in the Cloud Identity Engine portal and provide connection details
   • BCreate a user group in Prisma Access
   • CConfigure a security policy that references the identity source
   • DInstall a certificate on the Prisma Access gateway
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A mid-sized company is deploying Prisma Access and wants to authenticate users against their existing on-premises Active Directory. The company does not have an identity provider for SAML and wants to keep the deployment simple. The security team needs to authenticate users with their AD credentials and enforce policies based on AD group membership. Which authentication method should the administrator configure?

   • ALDAP authentication by connecting Prisma Access directly to the Active Directory server.
   • BSAML authentication using Active Directory Federation Services (AD FS) as the identity provider.
   • CKerberos authentication using the Active Directory key distribution center.
   • DCertificate-based authentication using certificates issued by Active Directory Certificate Services.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services firm is deploying Prisma Access for internal users who are already authenticated to the corporate Active Directory domain. The users access Prisma Access from domain-joined laptops on the corporate network. The security team wants to provide seamless access without prompting users for credentials again, while still enforcing identity-based policies. Which authentication method should the administrator configure?

   • ALDAP authentication with a bind to the corporate Active Directory.
   • BKerberos authentication using the corporate Active Directory as the key distribution center.
   • CSAML authentication with a third-party identity provider such as Okta or Azure AD.
   • DCertificate-based authentication using user certificates issued by the corporate PKI.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is deploying Prisma Access and wants to use Kerberos authentication for users on domain-joined laptops. The security team wants to ensure that identity-based policies reflect the user's group memberships. The administrator has configured Kerberos authentication in Prisma Access. What additional configuration is needed to enable identity-based policy enforcement?

   • AConfigure Cloud Identity Engine to connect to Active Directory and synchronize user and group information.
   • BConfigure a RADIUS server to proxy authentication and group information.
   • CConfigure a local user database in Prisma Access and manually add group memberships.
   • DConfigure a SAML identity provider to provide group information.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying Prisma Access and wants to use certificate-based authentication for all users. The security team wants to ensure that identity-based policies reflect the user's group memberships. The administrator has configured certificate-based authentication in Prisma Access. What additional configuration is needed to enable identity-based policy enforcement?

   • AConfigure a RADIUS server to proxy authentication and group information.
   • BConfigure Cloud Identity Engine to connect to the certificate authority and synchronize user and group information.
   • CConfigure a SAML identity provider to provide group information.
   • DConfigure a local user database in Prisma Access and manually add group memberships.
   Reveal Solution Discussion Select an answer first