User-ID, Redistribution & Prisma Access Quiz

Question 1

Which User-ID method maps IP addresses to usernames for users connecting through an 802.1x-enabled wireless network device that has no native integration with PAN-OS® software?

Explanation: While the XML API *can* be used, Syslog monitoring is the most common method for integrating with NAC/802.1x systems (like Cisco ISE, Aruba ClearPass) which log authentication events including username, IP, and MAC address. The firewall parses these syslog messages.

Question 2

A global corporate office has a large-scale network with only one User-ID agent, which creates a bottleneck near the User-ID agent server. Which solution in PAN-OS® software would help in this case?

Explanation: Redistribution allows firewalls to share User-ID mappings with each other (often via Panorama as a hub). This means not every firewall needs to talk directly to the overloaded agent; they can get the information from other firewalls or Panorama, alleviating the bottleneck.

Question 3

Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

Explanation: The User-ID Terminal Services (TS) agent is required. It runs on the TS/RDS server, assigns unique port ranges to each user session, and sends this User-IP-Port mapping to the firewall, allowing per-user identification and policy. This is referred to as port mapping.

Question 4

Which data flow describes redistribution of user mappings?

Explanation: Redistribution specifically refers to the process where one PAN-OS firewall (or Prisma Access instance) shares its learned User-ID mappings with another PAN-OS firewall (or Prisma Access instance). While agents send info *to* firewalls/Panorama, redistribution is the sharing *between* policy enforcement points.

Question 5

A company manages Prisma Access using Panorama and uses on-premises Active Directory (AD) for user groups. How can policies based on AD group mapping be learned and enforced in Prisma Access?

Explanation: Panorama needs a way to learn the group definitions from AD. This is achieved by designating an on-prem/VM firewall as a "Master Device" within a Device Group in Panorama. This Master Device queries AD/LDAP for groups, and Panorama retrieves this list. Prisma Access device groups are then linked (as children) to this Master Device Group to inherit the group information for policy use.

Question 6

A company has 10 Active Directory domain controllers spread across multiple WAN links with substantial bandwidth. The firewall's management plane is highly utilized. Given this scenario, which type of User-ID agent deployment is considered a best practice by Palo Alto Networks?

Explanation: While the integrated agent is convenient, it consumes management plane resources. In an environment with a highly utilized management plane and multiple DCs across a WAN, dedicating a standalone Windows server to run the User-ID agent is often the best practice. This offloads the monitoring task from the firewall's management plane.

Question 7

A company is using wireless controllers to authenticate users. Which source should be used for User-ID mappings?

Explanation: Many wireless controllers and Network Access Control (NAC) systems log authentication events via Syslog. The Palo Alto Networks firewall or Panorama can be configured with a Syslog Listener profile to parse these logs and extract User-ID mappings.

Question 8

What are three valid methods of collecting User-ID information in a network? (Choose three.)

Explanation: Valid methods include: 1) The dedicated Windows User-ID agent monitoring servers. 2) GlobalProtect, where the firewall learns the user during the VPN connection setup. 3) The XML API, allowing external systems to push mappings. EDLs and DUGs *use* User-ID info but don't *collect* the primary IP-to-User mapping.

Question 9

An engineer needs to collect User-ID mappings from the company’s existing proxies. What two methods can be used to pull this data from third party proxies? (Choose two.)

Explanation: Web proxies often log user activity via Syslog, which the firewall can parse. Additionally, proxies commonly insert the original client IP and authenticated username into HTTP headers, specifically the X-Forwarded-For (XFF) header. The firewall can be configured to read these headers to obtain User-ID mappings.

Question 10

Which feature can provide NGFWs with User-ID mapping information when users connect remotely?

Explanation: GlobalProtect is Palo Alto Networks' VPN solution. When users connect via the GlobalProtect client, the gateway authenticates the user and automatically creates a User-ID mapping for the IP address assigned to the client for the VPN session.

Question 11

Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)

Explanation: Dynamic User Groups (DUGs) populate based on tags associated with usernames. Tags can be assigned via the XML API (or CLI/GUI manually) or dynamically by the User-ID agent based on monitoring group membership changes in Active Directory. GlobalProtect agent status can also be used for DUG criteria, but it doesn't directly 'tag' in the same way as API/Agent group monitoring. Log forwarding auto-tagging tags *IP addresses*, not usernames.

Question 12

An administrator needs to build Security rules in a Device Group that allow traffic to specific users and groups defined in Active Directory. What must be configured in order to select users and groups for those rules from Panorama?

Explanation: For Panorama to be aware of AD groups so they can be selected in policies within a Device Group, a Master Device must be configured within that Device Group (or its parent). This Master Device performs the actual Group Mapping query (e.g., via LDAP) and provides the list of groups to Panorama.

Question 13

A network security administrator has an environment with multiple forms of authentication (wireless NAC, Windows DCs, MDM). All devices log authentication events. What is the best choice for deploying User-ID to ensure maximum coverage?

Explanation: Given multiple, diverse authentication sources that *all* produce logs, the Syslog Listener is the most versatile method. You configure each source (NAC, MDM, maybe even DCs if not using the agent) to send logs to the firewall/Panorama, which then parses them using defined filters to extract User-ID mappings.

Question 14

Your company occupies one floor in a single building with two AD domain controllers. The firewall’s management-plane resources are lightly utilized. Given this environment, which User-ID collection method is sufficient?

Explanation: In a small environment with lightly utilized management plane resources and only a couple of DCs, the PAN-OS integrated User-ID agent (Agentless User-ID) is usually sufficient and simplest to configure. It uses the firewall's management plane to monitor the DCs directly via WMI.

Question 15

After some firewall configuration changes, application identification fails, and sessions show as unknown-tcp. A high number of sessions are going to a discard state. What change could cause this?

Explanation: Allowing TCP segments to be forwarded before App-ID inspection is complete (often related to performance tuning or specific features) can lead to sessions being discarded or marked as unknown if App-ID cannot identify the application within the allowed timeframe or queue limits.

Question 16

What are three valid methods of collecting User-ID information in a network? (Choose three.)

Explanation: Valid User-ID collection methods include the Windows User-ID agent (monitoring DCs), GlobalProtect (learning from VPN users), and the XML API (receiving mappings from external systems). EDLs and DUGs are policy objects that *use* collected User-ID information, they don't collect the initial IP-to-user mapping.

Question 17

An administrator configures a Windows User-ID agent. The company uses four AD servers (192.168.28.32/28) and two Exchange servers (192.168.28.48/28), all within 192.168.28.32/27. What info is needed in the User Identification > Discovery section?

Explanation: The User-ID agent needs to be explicitly told which servers to monitor. You must provide the IP address (or hostname) and the type (Active Directory or Exchange) for each individual server you want it to query for login events.

Question 18

Which source is the most reliable for collecting User-ID user mapping?

Explanation: GlobalProtect provides the most direct and reliable mapping because the firewall itself is handling the user authentication for the VPN connection and assigning the IP address. It knows definitively which user is associated with which tunnel IP.

Question 19

Which two profiles should be configured when sharing tags from threat logs with a remote User-ID agent? (Choose two.)

Explanation: To share tags based on logs, you need a Log Forwarding profile to filter the logs and specify the action. The action to send tags externally uses an HTTP Server profile to define the destination URL and authentication for the receiving agent/system.

Question 20

A customer wants to deploy User-ID on an NGFW with multiple vsys. One vsys will support a GlobalProtect portal and gateway. The customer uses Windows AD. What is the most operationally efficient way to redistribute the most accurate IP addresses to username mappings?

Explanation: Since GlobalProtect provides highly accurate mappings, and mappings can be shared between vsys using a User-ID Hub, configuring the GP vsys as the hub is efficient. It collects accurate GP mappings and potentially monitors AD, then shares this with other vsys, reducing redundant agents.

Question 21

Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?

Explanation: Web proxies typically log user access via Syslog or insert user info into XFF headers. Syslog listening allows the firewall to parse these logs. While XFF is also valid (Q427), Syslog is listed as option A here and is a primary method. *Correction: The original PDF answer key indicates A (Syslog), updated here.*

Question 22

A company wants to use their Active Directory groups to simplify their Security policy creation from Panorama. Which configuration is necessary to retrieve groups from Panorama?

Explanation: Panorama learns AD group definitions for policy use via a designated Master Device configured within the relevant Device Group (or its parent).

Question 23

An administrator needs to build Security rules in a Device Group that allow traffic to specific users and groups defined in Active Directory. What must be configured in order to select users and groups for those rules from Panorama?

Explanation: To select AD groups in Panorama policies for a Device Group, a Master Device configured for Group Mapping must exist within that Device Group hierarchy.

Question 24

An engineer creates a set of rules in a Device Group (Panorama) to permit traffic to various services for a specific LDAP user group. What needs to be configured to ensure Panorama can retrieve user and group information for use in these rules?

Explanation: Panorama retrieves the user and group list information needed for policy creation via a configured Master Device within the Device Group hierarchy.

Question 25

An engineer needs to redistribute User-ID mappings from multiple data centers. Which data flow best describes redistribution of user mappings?

Explanation: User-ID redistribution is the mechanism for PAN-OS firewalls (and Prisma Access instances) to share learned IP-to-user mappings directly with each other, often facilitated by Panorama acting as a central hub.