1.7 Configure and Implement Identity Authentication Within Prisma Access SECURITY-SERVICE-EDGE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the role of the Key Distribution Center (KDC) in Kerberos authentication for Prisma Access?

   • ATo store the user's password in plain text for quick verification
   • BTo encrypt all traffic between the user and Prisma Access
   • CTo act as a backup authentication server if the primary directory fails
   • DTo issue and validate ticket-granting tickets (TGTs) and service tickets
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization is implementing SAML authentication for Prisma Access using Okta as the identity provider. The administrator has configured the SAML SSO profile in Prisma Access and uploaded the IdP metadata. However, when users attempt to authenticate, they receive an error indicating that the user is not recognized. The administrator has verified that the SAML assertion contains the correct user email address. What is the most likely missing configuration step?

   • AConfigure user mapping in Cloud Identity Engine to associate the SAML assertion attributes with the identity source user records.
   • BEnsure that the SAML assertion includes the user's group memberships in addition to the email address.
   • CConfigure a RADIUS server as a fallback authentication method for SAML users.
   • DEnable Kerberos authentication in addition to SAML to validate the user's identity against Active Directory.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does Cloud Identity Engine centralize identity management for Prisma Access?

   • ABy storing all user passwords in a central vault and authenticating users directly
   • BBy requiring each Prisma Access gateway to maintain its own local user database
   • CBy aggregating user and group information from multiple identity sources into a single cloud-based service that Prisma Access can query
   • DBy creating a separate identity for each user in every connected directory
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is deploying Prisma Access and has users in multiple directories, including Active Directory and an HR system. The security team wants to enforce identity-based policies that reflect the user's role and department. They also want to support SAML-based SSO for all users. Which component should the administrator use to centralize identity management?

   • AA RADIUS server to proxy authentication to all identity sources.
   • BA SAML identity provider to authenticate users from all directories.
   • CA local user database in Prisma Access to store all user records.
   • DCloud Identity Engine to connect to all identity sources and provide a unified identity store.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   After connecting an identity source to Cloud Identity Engine, what must be done to enable identity-based policy enforcement in Prisma Access?

   • AConfigure security policies that reference the synchronized users and groups
   • BCreate a separate VPN tunnel for each user group
   • CReboot all Prisma Access gateways to load the new identity data
   • DNothing; policies automatically use the connected identity source
   Reveal Solution Discussion Select an answer first