An engineer is implementing a new rollout of SAML for administrator authentication across
a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is
currently performed with RADIUS, which will remain available for six months, until it is
decommissioned. The company wants both authentication types to be running in parallel
during the transition to SAML.
Which two actions meet the criteria? (Choose two.)
A. Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
B. Create an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.
C. Create and apply an authentication profile with the “SAML Identity Provider” Server Profile.
D. Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.
Answer Option (Which option is correct) B. Create an authentication sequence that includes both the “RADIUS” Server Profile and
“SAML Identity Provider” Server Profile to run the two services in tandem.
Answer Option (Which option is correct) D. Create and add the “SAML Identity Provider” Server Profile to the authentication profile
for the “RADIUS” Server Profile.
Explanation:
The answer shown above is the supplied answer and has been retained unchanged. Verification note: The supplied choose-two question has no supported pair. C is the valid SAML-profile creation step, but SAML profiles cannot be included in authentication sequences, and one authentication profile cannot simultaneously use a RADIUS and SAML server profile. Separate administrator accounts or an explicitly documented migration design are needed. The original B,D key is retained as requested, but it conflicts with the documented configuration requirements.
Why the other options are incorrect:
A. Create a testing and rollback plan for the transition from Radius to SAML, as the two
authentication profiles cannot be run in tandem:
A testing and rollback plan is sensible migration practice. However, claiming the two methods cannot coexist anywhere is too broad because different administrator accounts can use different profiles. This option does not supply a precise supported parallel-authentication configuration.
C. Create and apply an authentication profile with the “SAML Identity Provider” Server
Profile:
Creating a SAML Authentication profile is a supported step. This choice is not incorrect in isolation. It supplies only one valid action and does not rescue the requested two-answer combination.
References:
Palo Alto Networks - Configure an Authentication Profile and Sequence
By default, which type of traffic is configured by service route configuration to use the management interface?
A. Security zone
B. IPSec tunnel
C. Virtual system (VSYS)
D. Autonomous Digital Experience Manager (ADEM)
Answer Option (Which option is correct) D. Autonomous Digital Experience Manager (ADEM)
Explanation:
The answer shown above is the supplied answer and has been retained unchanged. Verification note: The specific ADEM service-route claim could not be verified in the retrieved official documentation. General service-route defaults do not prove that every ADEM feature or plugin uses the management interface in the unspecified release. The other choices name zones, tunnels, or VSYS contexts rather than a comparable named service. Specify the PAN-OS and ADEM versions and provide the applicable service-route reference before assigning D.
Why the other options are incorrect:
A. Security zone:
A Security zone groups interfaces for policy enforcement. It is not a named management service route. Its presence does not identify traffic that defaults to the management interface.
B. IPSec tunnel:
An IPSec tunnel is a VPN transport construct. Its peer reachability and tunnel routing are configured independently. It is not the ordinary named service-route entry described in the question.
C. Virtual system (VSYS):
A VSYS is a firewall partition and configuration context. It is not itself a traffic type or named destination service. This does not establish a default management-interface service route.
References:
Palo Alto Networks - About SD-WAN - ADEM Integration Requirements
An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks
firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is
reported that clients located behind the various interfaces cannot communicate with each
other.
Which action taken by the engineer will resolve this issue?
A. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.
B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
C. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
D. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.
Answer Option (Which option is correct) B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows
traffic within the VLAN.
Explanation:
The answer shown above is the supplied answer and has been retained unchanged. Verification note: Both B and C can permit the interzone Layer 2 traffic described, so the single-answer question is ambiguous. Interfaces must share the VLAN and have appropriate Layer 2 zones. Traffic between different zones needs a permitting Security rule; same-zone traffic is allowed by the default rule unless overridden. IP routing is not required for same-VLAN switching.
Why the other options are incorrect:
A. Configure each interface to belong to the same Layer 2 zone and enable IP routing
between them:
IP routing is unnecessary between interfaces switching the same VLAN. A shared Layer 2 zone can allow traffic under the default intrazone rule. The routing requirement makes this proposed remedy incorrect.
C. Assign each interface to the appropriate Layer 2 zone and configure Security policies for
interfaces not assigned to the same zone:
Allowing traffic between different Layer 2 zones is a valid remedy when VLAN membership is correct. The default interzone deny would otherwise block those sessions. This cannot be marked incorrect while B remains the keyed answer.
D. Enable IP routing between the interfaces and configure a Security policy to allow traffic
between interfaces within the VLAN:
Enabling IP routing does not resolve a same-VLAN Layer 2 policy issue. Security policy remains relevant, but the interfaces are switching rather than routing this traffic. The unnecessary routing step makes the complete option misleading.
References:
Palo Alto Networks - How Do Zones Protect the Network?
To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers. Resources exist on AWS and Azure:
The AWS deployment is architected with AWS Transit Gateway, to which all resources connect
The Azure deployment is architected with each application independently routing traffic
The engineer deploying Cloud NGFW in these two cloud environments must account for the following:
Minimize changes to the two cloud environments
Scale to the demands of the applications while using the least amount of compute resources
Allow the company to unify the Security policies across all protected areas
Which two implementations will meet these requirements? (Choose two.)
A. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama.
B. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.
C. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules.
D. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.
Answer Option (Which option is correct) B. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.
Answer Option (Which option is correct) D. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.
Explanation:
Use an Azure VNet deployment with routing through Cloud NGFW for the existing VNet-based application design. In AWS, centralized Cloud NGFW inspection can integrate with the existing Transit Gateway and security VPC. Panorama integration supplies a common policy-management approach for both services. Provisioning, credits, licensing, and supported integration prerequisites still apply.
Why the other options are incorrect:
A. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama:
Per-VPC VM-Series deployment substitutes a different operating model for the purchased Cloud NGFW service. A new cross-cloud IPSec tunnel is not required by the stated inspection design. It also adds changes rather than using the existing centralized AWS topology.
C. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules:
Creating a new vWAN changes the described Azure routing architecture. Managing only local rules also fails the common Panorama policy requirement. A VNet deployment better matches the existing independent application routing.
References:
Palo Alto Networks - Cloud NGFW for AWS Centralized Deployments
Palo Alto Networks - Cloud NGFW for Azure Deployment Architectures
A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency.
Which approach best addresses these requirements while maintaining consistent policy enforcement?
A. Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CA. Turn off certificate revocation checks for lower overhead, rely on IP-based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices.
B. Distribute the root and intermediate CA certificates through Panorama templates. Configure certificate profiles for OCSP validation using the internal responder, with CRL checks as appropriate. Maintain distinct user and device profiles where their identity settings differ, and automate endpoint enrollment through Group Policy or SCEP.
C. Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall's local certificate store for authentication.
D. Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency.
Answer Option (Which option is correct) B. Distribute the root and intermediate CA certificates through Panorama templates. Configure certificate profiles for OCSP validation using the internal responder, with CRL checks as appropriate. Maintain distinct user and device profiles where their identity settings differ, and automate endpoint enrollment through Group Policy or SCEP.
Explanation:
Distribute the enterprise CA trust chain and certificate profiles consistently through Panorama templates. Certificate profiles can validate revocation through OCSP using certificate AIA or a configured default responder URL, with CRL checks as appropriate. Enroll endpoint certificates through the enterprise PKI using supported automation. This centralizes trust configuration without placing endpoint private keys on the firewalls.
Why the other options are incorrect:
A. Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CA. Turn off certificate revocation checks for lower overhead, rely on IP-based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices:
Turning off revocation checks contradicts the requirement for frequent OCSP validation. Site self-signed credentials also bypass the enterprise AD CS hierarchy. IP-based rules cannot substitute for the requested certificate-authentication controls.
C. Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall's local certificate store for authentication:
Independent configuration and manual CRL checks increase administrative effort and omit the requested OCSP workflow. Endpoint private keys are normally held by endpoints rather than centrally imported for their authentication. The proposal therefore fails both consistency and efficient revocation requirements.
D. Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency:
A wildcard server certificate is not a unique user or machine credential. Manual endpoint installation and SSH-based store changes do not provide the requested centralized deployment process. Default CRL polling also omits the specified OCSP approach.
References:
Palo Alto Networks - Configure a Certificate Profile
Palo Alto Networks - GlobalProtect Certificate Best Practices
An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.
How does the GlobalProtect agent process the authentication flow on Windows endpoints?
A. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
B. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
C. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
D. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.
Answer Option (Which option is correct) A. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
Explanation:
GlobalProtect can establish a machine-certificate pre-logon tunnel before a Windows user signs in. After user login, it performs the configured SAML authentication, including the IdP MFA requirements, to establish the user identity. Pre-logon access and authenticated user access can receive different policy. Prompts and SSO behavior depend on the IdP and app configuration.
Why the other options are incorrect:
B. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA:
A machine certificate establishes device identity during pre-logon. It does not replace the separately configured SAML user-authentication requirement. Reusing it alone would omit the requested MFA stage.
C. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user:
Windows credentials do not automatically complete every SAML MFA challenge. The IdP determines the required user verification and supported SSO behavior. A certificate-validated pre-logon tunnel is not proof that user MFA has succeeded.
D. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant:
Pre-logon specifically occurs before interactive user sign-in. Its machine-certificate tunnel can exist before the later SAML flow. Requiring user login first reverses the stated design.
References:
Palo Alto Networks - Pre-Logon for SAML Authentication
An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to transition between zones without leaving the firewall (no external physical connections). The interfaces for each VSYS are assigned to separate virtual routers (VRs), and inter-VR static routes have been configured. An external zone has been created correctly for each VSYS. Security policies have been added to permit the desired traffic between each zone and its respective external zone. However, the desired traffic is still unable to successfully pass from one VSYS to the other in either direction.
Which additional configuration task is required to resolve this issue?
A. Create a transit VSYS and route all inter-VSYS traffic through it.
B. Add each VSYS to the list of visible virtual systems of the other VSYS.
C. Enable the "allow inter-VSYS traffic" option in both external zone configurations.
D. Create Security policies to allow the traffic between the two external zones.
Answer Option (Which option is correct) B. Add each VSYS to the list of visible virtual systems of the other VSYS.
Explanation:
Inter-VSYS communication inside the firewall requires the virtual systems to be visible to each other. With routes, external zones, and Security rules already configured, adding reciprocal visibility supplies the missing prerequisite. Each VSYS can then use its external zone to refer to the permitted peer VSYS.
Why the other options are incorrect:
A. Create a transit VSYS and route all inter-VSYS traffic through it:
A transit VSYS is not required for direct internal communication between the two configured systems. It would add another routing and policy layer. The documented missing prerequisite is mutual visibility.
C. Enable the "allow inter-VSYS traffic" option in both external zone configurations:
There is no separate allow inter-VSYS traffic checkbox that replaces visibility in this workflow. The external zone lists reachable virtual systems. Those relationships depend on the Visible Virtual System configuration.
D. Create Security policies to allow the traffic between the two external zones:
Security rules apply between the relevant internal and external zones within each VSYS. Creating a cross-context rule between two external zones is not the missing visibility setting. The scenario already states that the required per-VSYS rules exist.
References:
Palo Alto Networks - Configure Inter-Virtual System Communication within the Firewall
An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS, Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-west traffic within each cluster, maintain consistent Security policies across all environments, and dynamically scale as containerized workloads spin up or down. They also plan to use a centralized Panorama instance for policy management and visibility.
Which approach meets these requirements?
A. Install standalone CN-Series instances in each cluster with local configuration only. Export daily policy configuration snapshots to Panorama for recordkeeping, but do not unify policy enforcement.
B. Configure the CN-Series only in public cloud clusters, and rely on Kubernetes Network Policies for on-premises cluster security. Synchronize partial policy information into Panorama manually as needed.
C. Use Kubernetes-native tools such as Helm to deploy CN-Series in each supported cluster with supported CNI traffic insertion. Manage the CN-Series firewalls centrally through Panorama and apply consistent Security policies across on-premises and cloud clusters.
D. Deploy a single CN-Series firewall in the on-premises data center to process traffic for all clusters, connecting remote clusters via VPN or peering. Manage this single instance through Panorama.
Answer Option (Which option is correct) C. Use Kubernetes-native tools such as Helm to deploy CN-Series in each supported cluster with supported CNI traffic insertion. Manage the CN-Series firewalls centrally through Panorama and apply consistent Security policies across on-premises and cloud clusters.
Explanation:
Deploy CN-Series in each supported Kubernetes cluster using the appropriate Helm or manifest workflow and local traffic interception. Panorama provides consistent policy management and visibility across those deployments. The cluster CNI and deployment mode must be supported, and scaling requires the relevant deployment configuration. CN-Series should not be treated as a generic service-mesh plugin.
Why the other options are incorrect:
A. Install standalone CN-Series instances in each cluster with local configuration only. Export daily policy configuration snapshots to Panorama for recordkeeping, but do not unify policy enforcement:
Daily configuration snapshots are records rather than centralized policy enforcement. Independent local configurations can diverge between clusters. This contradicts the stated requirement for consistent Panorama-managed policy.
B. Configure the CN-Series only in public cloud clusters, and rely on Kubernetes Network Policies for on-premises cluster security. Synchronize partial policy information into Panorama manually as needed:
Securing only public-cloud clusters leaves the on-premises clusters outside the requested CN-Series coverage. Kubernetes NetworkPolicy is not equivalent to NGFW application and threat inspection. Manual partial synchronization also increases administrative effort.
D. Deploy a single CN-Series firewall in the on-premises data center to process traffic for all clusters, connecting remote clusters via VPN or peering. Manage this single instance through Panorama:
One remote CN-Series instance is not the supported replacement for cluster-local insertion across all clusters. East-west traffic must actually be steered through an enforcement point. Centralizing every cluster path through the data center also conflicts with the stated scaling objective.
References:
Palo Alto Networks - Deploy CN-Series Firewalls With (Recommended) and Without the Helm Chart
A PA-Series firewall with all licensable features is being installed. The customer's Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions.
Which action meets the requirements in this scenario?
A. Deploy the transparent proxy with Web Cache Communications Protocol (WCCP).
B. Deploy the Next-Generation Firewalls as normal and install the User-ID agent.
C. Deploy the Advanced URL Filtering license and captive portal.
D. Deploy the explicit proxy with Kerberos authentication scheme.
Answer Option (Which option is correct) D. Deploy the explicit proxy with Kerberos authentication scheme.
Explanation:
An explicit web proxy accepts configured client web requests and establishes the onward web connection. Kerberos authentication integrates the proxy with the Active Directory identity environment. The deployment also needs supported hardware, software, service-account settings, and policy to prevent direct bypass. A license alone does not establish the full proxy design.
Why the other options are incorrect:
A. Deploy the transparent proxy with Web Cache Communications Protocol (WCCP):
WCCP is not the documented explicit-proxy Kerberos deployment selected by these requirements. Transparent interception also differs from clients deliberately using a configured proxy. This choice does not supply the stated authentication approach.
B. Deploy the Next-Generation Firewalls as normal and install the User-ID agent:
A User-ID agent learns identity mappings for policy. A normal routed firewall does not thereby become the web connection originator for every client request. The proxy requirement remains unmet.
C. Deploy the Advanced URL Filtering license and captive portal:
Advanced URL Filtering and Authentication Portal control web access and authentication workflows. They do not by themselves deploy the required explicit proxy. The client-to-proxy connection architecture still must be configured.
References:
Palo Alto Networks - Configure Authentication for Explicit Web Proxy
When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?
A. Flood Protection
B. Protocol Protection
C. Packet-Based Attack Protection
D. Reconnaissance Protection
Answer Option (Which option is correct) C. Packet-Based Attack Protection
Explanation:
Packet-Based Attack Protection contains controls for individual malformed or suspicious packets, including spoofed IP address checks and TCP split-handshake protection. These settings are part of a Zone Protection profile. Flood, reconnaissance, and protocol protections address other attack patterns rather than these specific packet checks.
Why the other options are incorrect:
A. Flood Protection:
Flood Protection applies rate-based controls to floods such as SYN, UDP, or ICMP attacks. It does not provide the named per-packet spoofing and handshake checks. Those belong to Packet-Based Attack Protection.
B. Protocol Protection:
Protocol Protection controls allowed or blocked protocol behavior at the zone level. It is not the section containing the cited TCP split-handshake and spoofed-address options. The original key selected the wrong protection category.
D. Reconnaissance Protection:
Reconnaissance Protection detects activities such as host sweeps and port scans. It addresses discovery attempts across hosts or ports. It does not replace the individual packet checks specified here.
References:
Palo Alto Networks - Zone Protection Profiles
Which two statements describe an external zone used for internal inter-VSYS communication on a Palo Alto Networks firewall? (Choose two.)
A. It is associated with an interface within a VSYS of a firewall.
B. It is a security object associated with a specific virtual router of a VSYS.
C. It is not associated with an interface; it is associated with a VSYS itself.
D. It is a security object associated with a specific VSYS.
Answer Option (Which option is correct) C. It is not associated with an interface; it is associated with a VSYS itself.
Answer Option (Which option is correct) D. It is a security object associated with a specific VSYS.
Explanation:
An external zone is a Security object used for inter-VSYS traffic that remains inside the firewall. It belongs to a virtual system and identifies the other visible virtual systems it can reach. It is not bound to a physical interface. Mutual visibility, routing, and Security policy complete the communication design.
Why the other options are incorrect:
A. It is associated with an interface within a VSYS of a firewall:
An external zone does not bind to an interface in the same way as a Layer 3 or Virtual Wire zone. Its configuration identifies reachable virtual systems. The option incorrectly gives it an interface association.
B. It is a security object associated with a specific virtual router of a VSYS:
A virtual router supplies routing information, but is not the external-zone object association. The external zone is configured in a VSYS and refers to other visible VSYS objects. Routing and zone policy are separate parts of the design.
References:
Palo Alto Networks - Building Blocks of Security Zones
A multinational organization wants to use the Cloud Identity Engine (CIE) to aggregate identity data from multiple sources (on premises AD, Azure AD, Okta) while enforcing strict data isolation for different regional business units. Each region's firewalls, managed via Panorama, must only receive the user and group information relevant to that region. The organization aims to minimize administrative overhead while meeting data sovereignty requirements.
Which approach achieves this segmentation of identity data?
A. Create one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information.
B. Establish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region's firewalls, maintaining a strict one-to-one mapping of tenant to business unit.
C. Disable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs).
D. Deploy a single CIE tenant that collects all identity data, then configure segments within the tenant to filter and redistribute only the relevant user/group sets to each regional firewall group.
Answer Option (Which option is correct) B. Establish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region's firewalls, maintaining a strict one-to-one mapping of tenant to business unit.
Explanation:
Separate Cloud Identity Engine tenants can isolate directory data and control which applications or firewalls access each directory set. Regional instances and their authorized consumers must align with the required data-residency design. Segments support granular redistribution of mapping context, but do not automatically create separate regional directory-storage boundaries. The tenant approach best matches the strict isolation requirement.
Why the other options are incorrect:
A. Create one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information:
Sending the full directory dataset to every firewall violates the stated isolation objective. Security rules control traffic access, not whether a device receives directory data. Restricting policy matches after distribution does not undo that exposure.
C. Disable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs):
Direct local directory queries avoid using the requested CIE aggregation workflow. They also create independent configurations on regional firewalls. This fails the requirement for centralized identity aggregation with controlled distribution.
D. Deploy a single CIE tenant that collects all identity data, then configure segments within the tenant to filter and redistribute only the relevant user/group sets to each regional firewall group:
Segments can scope mapping-context redistribution within a tenant. That is different from isolating entire directory datasets and their regional storage. A single collecting tenant does not automatically satisfy the strict data-sovereignty requirement.
References:
Palo Alto Networks - Create Cloud Identity Engine Tenants
Palo Alto Networks - Cloud Identity Engine System Requirements
| Page 1 out of 5 Pages |
| 12 |
| Activity | Suggested time |
|---|---|
| Read official documentation and map objectives | 40 minutes |
| Hands-on lab or configuration tracing | 55 minutes |
| Practice Test session | 30 minutes |
| Review weak areas and notes | 25 minutes |
| Total | 150 minutes |
Real-World Scenario Mastery: Our NGFW-Engineer practice exam don't just test definitions. They present you with the same complex, scenario-based problems you'll encounter on the actual exam.
Strategic Weakness Identification: Each practice session reveals exactly where you stand. Discover which domains need more attention, before Palo Alto Networks Next-Generation Firewall Engineer exam day arrives.
Confidence Through Familiarity: There's no substitute for knowing what to expect. When you've worked through our comprehensive NGFW-Engineer practice exam questions pool covering all topics, the real exam feels like just another practice session.
Copyright © All Rights Reserved