2.4 Configure and Implement User-Based Policies Within Prisma Access SECURITY-SERVICE-EDGE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a hybrid environment with both on-premises Active Directory and Azure AD. They use Cloud Identity Engine to sync users from both directories. They notice that user group memberships are inconsistent: some users show the correct groups, but others show stale or missing groups. The sync is configured to run every 30 minutes. What is the most likely cause?

   • AThe sync is pulling from multiple sources and the group membership is being overwritten by the last sync.
   • BThe synchronization schedule is too frequent.
   • CThe User-ID agent is not installed on the domain controllers.
   • DThe captive portal is not configured for the users.
   Reveal Solution Discussion Select an answer first
2. 7foundation · medium

   What is the purpose of configuring a synchronization schedule in Cloud Identity Engine?

   • ATo ensure user and group information remains up to date in Prisma Access
   • BTo control the bandwidth used by Prisma Access for all traffic
   • CTo define when users can access the network
   • DTo schedule firewall software updates
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   Where is a User-ID agent typically deployed to collect user-to-IP mappings?

   • AOn the firewall itself
   • BOn each end-user's computer
   • CIn the cloud as a SaaS service
   • DOn a server within the network that can query directory services
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   Which component of Prisma Access relies on Cloud Identity Engine to provide user and group information for policy enforcement?

   • AUser-ID agent
   • BIdentity-based security policies
   • CGlobalProtect gateway
   • DPrisma Access infrastructure
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An administrator is troubleshooting why a user-based policy is not working for a group of users in Prisma Access. The users are synced from Azure AD via Cloud Identity Engine, and the group mapping is correct. The users are accessing the internet from a remote location. The administrator has verified that the user-to-IP mappings are present. What is the most likely remaining cause?

   • AThe users are not in the correct Azure AD group.
   • BThe User-ID agent is not installed on the users' devices.
   • CThe Cloud Identity Engine synchronization schedule is too long.
   • DThe security policy rule is using the wrong source zone or address.
   Reveal Solution Discussion Select an answer first