Palo Alto Networks NGFW-Engineer Value Pack (Frequently Bought Together)

Which method creates the most reliable user-to-IP mapping due to being based on a direct authentication from the user's device to the firewall?

• A. Polling security event logs with a User-ID agent
• B. Authentication logs from Syslog receiver
• C. PAN-OS XML API to push mappings
• D. Portal authentication

A network security engineer wants to create Security policy rules that allow or deny traffic based on a user's department, which corresponds to groups in the company's Active Directory. To achieve this, the firewall needs to retrieve group information from the directory server.
Which configuration object must be created first to establish the connection with the Active Directory server?

• A. User-ID agent service account
• B. Authentication sequence
• C. Kerberos server profile
• D. LDAP server profile

What is the requirement for interface link speeds when configuring a virtual wire on a Palo Alto Networks firewall?

• A. They must be the same media type.
• B. They must be configured with auto-negotiate settings regardless of the port type.
• C. They must all be either copper or fiber optic, however they can be different.
• D. They must have the same link speed and transmission mode.

Which statement applies to Log Collector Groups?

• A. Log redundancy is available only if each Log Collector has the same amount of total disk storage.
• B. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.
• C. Enabling redundancy increases the log processing traffic in a Collector Group by 50%.
• D. In any single Collector Group, all the Log Collectors must run on the same Panorama model.

A multinational organization wants to use the Cloud Identity Engine (CIE) to aggregate identity data from multiple sources (on premises AD, Azure AD, Okta) while enforcing strict data isolation for different regional business units. Each region's firewalls, managed via Panorama, must only receive the user and group information relevant to that region. The organization aims to minimize administrative overhead while meeting data sovereignty requirements.
Which approach achieves this segmentation of identity data?

• A. Disable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs).
• B. Establish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region's firewalls, maintaining a strict one-to-one mapping of tenant to business unit.
• C. Create one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information.
• D. Deploy a single CIE tenant that collects all identity data, then configure segments within the tenant to filter and redistribute only the relevant user/group sets to each regional firewall group.