2.4 Configure and Implement User-Based Policies Within Prisma Access SECURITY-SERVICE-EDGE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses Prisma Access with Cloud Identity Engine. They have configured a security policy that allows 'Sales' group to access a CRM application, but blocks all other users. A user in the 'Sales' group is being blocked. The user is synced and appears in the correct group in Cloud Identity Engine. What should the administrator verify?

   • AThat the user's IP address is mapped to the user identity in Prisma Access.
   • BThat the user is using a managed device with a User-ID agent.
   • CThat the security policy rule is placed above any deny rules.
   • DThat the CRM application is accessible from the user's location.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses Prisma Access for remote users. They want to enforce different security policies based on the user's department, which is stored in Azure AD. They have already deployed Cloud Identity Engine and synced users and groups. However, when a user in the Finance group connects, the policy applied is the generic 'remote-users' policy instead of the 'finance-policy'. What is the most likely missing configuration step?

   • ACreate a User-ID agent on the user's endpoint to collect user-to-IP mapping.
   • BEnable the XML API on the firewall to pull user-group information from Azure AD.
   • CMap the Azure AD 'Finance' group to a Prisma Access policy group and reference that group in the security policy.
   • DConfigure a captive portal to authenticate the user before they can access the network.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   What is the primary role of the Cloud Identity Engine in Prisma Access?

   • ATo replace the firewall's built-in authentication portal for all user authentication.
   • BTo provide a VPN gateway for remote users to connect to Prisma Access.
   • CTo store and manage all user passwords and credentials in the cloud.
   • DTo provide a centralized cloud-based service that synchronizes user and group information from identity providers for use in policy enforcement.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   What is the result of a successful User-ID mapping lookup in Prisma Access?

   • AThe traffic is associated with a specific user and can be matched against user-based policies
   • BThe user's password is verified
   • CThe traffic is automatically allowed
   • DThe user is added to a local database
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has a remote office with Windows servers that host file shares. They want to enforce user-based policies in Prisma Access for users accessing the internet from these servers. The servers are not domain-joined, but they do have a local user database. What is the best way to collect user-to-IP mappings for these servers?

   • ADeploy a User-ID agent on each server to collect user-to-IP mappings from the local user database.
   • BUse the XML API to pull user-to-IP mappings from the local user database.
   • CConfigure a captive portal on the firewall to authenticate users when they access the internet.
   • DIntegrate the servers with Cloud Identity Engine to sync local users.
   Reveal Solution Discussion Select an answer first