Paloalto Networks PSE-Strata-Pro-24 Practice Exams
Last updated on Oct 21,2026- Exam Code: PSE-Strata-Pro-24
- Exam Name: Palo Alto Networks Systems Engineer Professional - Hardware Firewall
- Certification Provider: Paloalto Networks
- Latest update: Oct 21,2026
Question #21
A customer sees unusually high DNS traffic to an unfamiliar IP address.
Which Palo Alto Networks Cloud-Delivered Security Services (CDSS) subscription should be enabled to further inspect this traffic?
- A . Advanced Threat Prevention
- B . Advanced WildFire
- C . Advanced URL Filtering
- D . Advanced DNS Security
Correct Answer: D
D
Explanation:
The appropriate CDSS subscription to inspect and mitigate suspicious DNS traffic is Advanced DNS Security.
Here’s why:
Advanced DNS Security protects against DNS-based threats, including domain generation algorithms (DGA), DNS tunneling (often used for data exfiltration), and malicious domains used in attacks. It leverages machine learning to detect and block DNS traffic associated with command-and-control servers or other malicious activities. In this case, unusually high DNS traffic to an unfamiliar IP address is likely indicative of a DNS-based attack or malware activity, making this the most suitable service.
Option A: Advanced Threat Prevention (ATP) focuses on identifying and blocking sophisticated threats in network traffic, such as exploits and evasive malware. While it complements DNS Security, it does not specialize in analyzing DNS-specific traffic patterns.
Option B: Advanced WildFire focuses on detecting and preventing file-based threats, such as malware delivered via email attachments or web downloads. It does not provide specific protection for DNS-related anomalies.
Option C: Advanced URL Filtering is designed to prevent access to malicious or inappropriate websites based on their URLs. While DNS may be indirectly involved in resolving malicious websites, this service does not directly inspect DNS traffic patterns for threats.
Option D (Correct): Advanced DNS Security specifically addresses DNS-based threats. By enabling this service, the customer can detect and block DNS queries to malicious domains and investigate anomalous DNS behavior like the high traffic observed in this scenario.
How to Enable Advanced DNS Security:
Ensure the firewall has a valid Advanced DNS Security license.
Navigate to Objects > Security Profiles > Anti-Spyware.
Enable DNS Security under the "DNS Signatures" section.
Apply the Anti-Spyware profile to the relevant Security Policy to enforce DNS Security.
Reference: Palo Alto Networks Advanced DNS Security Overview: https://www.paloaltonetworks.com/dns-security
Best Practices for DNS Security Configuration.
D
Explanation:
The appropriate CDSS subscription to inspect and mitigate suspicious DNS traffic is Advanced DNS Security.
Here’s why:
Advanced DNS Security protects against DNS-based threats, including domain generation algorithms (DGA), DNS tunneling (often used for data exfiltration), and malicious domains used in attacks. It leverages machine learning to detect and block DNS traffic associated with command-and-control servers or other malicious activities. In this case, unusually high DNS traffic to an unfamiliar IP address is likely indicative of a DNS-based attack or malware activity, making this the most suitable service.
Option A: Advanced Threat Prevention (ATP) focuses on identifying and blocking sophisticated threats in network traffic, such as exploits and evasive malware. While it complements DNS Security, it does not specialize in analyzing DNS-specific traffic patterns.
Option B: Advanced WildFire focuses on detecting and preventing file-based threats, such as malware delivered via email attachments or web downloads. It does not provide specific protection for DNS-related anomalies.
Option C: Advanced URL Filtering is designed to prevent access to malicious or inappropriate websites based on their URLs. While DNS may be indirectly involved in resolving malicious websites, this service does not directly inspect DNS traffic patterns for threats.
Option D (Correct): Advanced DNS Security specifically addresses DNS-based threats. By enabling this service, the customer can detect and block DNS queries to malicious domains and investigate anomalous DNS behavior like the high traffic observed in this scenario.
How to Enable Advanced DNS Security:
Ensure the firewall has a valid Advanced DNS Security license.
Navigate to Objects > Security Profiles > Anti-Spyware.
Enable DNS Security under the "DNS Signatures" section.
Apply the Anti-Spyware profile to the relevant Security Policy to enforce DNS Security.
Reference: Palo Alto Networks Advanced DNS Security Overview: https://www.paloaltonetworks.com/dns-security
Best Practices for DNS Security Configuration.
Question #22
In addition to Advanced DNS Security, which three Cloud-Delivered Security Services (CDSS)
subscriptions utilize inline machine learning (ML)? (Choose three)
- A . Enterprise DLP
- B . Advanced URL Filtering
- C . Advanced WildFire
- D . Advanced Threat Prevention
- E . IoT Security
Correct Answer: A, B, D
A, B, D
Explanation:
To answer this question, let’s analyze each Cloud-Delivered Security Service (CDSS) subscription and its role in inline machine learning (ML). Palo Alto Networks leverages inline ML capabilities across several of its subscriptions to provide real-time protection against advanced threats and reduce the need for manual intervention.
A, B, D
Explanation:
To answer this question, let’s analyze each Cloud-Delivered Security Service (CDSS) subscription and its role in inline machine learning (ML). Palo Alto Networks leverages inline ML capabilities across several of its subscriptions to provide real-time protection against advanced threats and reduce the need for manual intervention.
Question #23
The PAN-OS User-ID integrated agent is included with PAN-OS software and comes in which two forms? (Choose two.)
- A . Integrated agent
- B . GlobalProtect agent
- C . Windows-based agent
- D . Cloud Identity Engine (CIE)
Correct Answer: A, C
A, C
Explanation:
User-ID is a feature in PAN-OS that maps IP addresses to usernames by integrating with various directory services (e.g., Active Directory). User-ID can be implemented through agents provided by Palo Alto Networks.
Here’s how each option applies:
Option A: Integrated agent
The integrated User-ID agent is built into PAN-OS and does not require an external agent installation. It is configured directly on the firewall and integrates with directory services to retrieve user information.
This is correct.
Option B: GlobalProtect agent
GlobalProtect is Palo Alto Networks’ VPN solution and does not function as a User-ID agent. While it can be used to authenticate users and provide visibility, it is not categorized as a User-ID agent.
This is incorrect.
Option C: Windows-based agent
The Windows-based User-ID agent is a standalone agent installed on a Windows server. It collects user mapping information from directory services and sends it to the firewall.
This is correct.
Option D: Cloud Identity Engine (CIE)
The Cloud Identity Engine provides identity services in a cloud-native manner but is not a User-ID agent. It synchronizes with identity providers like Azure AD and Okta.
This is incorrect.
Reference: Palo Alto Networks documentation on User-ID
Knowledge Base article on User-ID Agent Options
A, C
Explanation:
User-ID is a feature in PAN-OS that maps IP addresses to usernames by integrating with various directory services (e.g., Active Directory). User-ID can be implemented through agents provided by Palo Alto Networks.
Here’s how each option applies:
Option A: Integrated agent
The integrated User-ID agent is built into PAN-OS and does not require an external agent installation. It is configured directly on the firewall and integrates with directory services to retrieve user information.
This is correct.
Option B: GlobalProtect agent
GlobalProtect is Palo Alto Networks’ VPN solution and does not function as a User-ID agent. While it can be used to authenticate users and provide visibility, it is not categorized as a User-ID agent.
This is incorrect.
Option C: Windows-based agent
The Windows-based User-ID agent is a standalone agent installed on a Windows server. It collects user mapping information from directory services and sends it to the firewall.
This is correct.
Option D: Cloud Identity Engine (CIE)
The Cloud Identity Engine provides identity services in a cloud-native manner but is not a User-ID agent. It synchronizes with identity providers like Azure AD and Okta.
This is incorrect.
Reference: Palo Alto Networks documentation on User-ID
Knowledge Base article on User-ID Agent Options
Question #24
Which two actions can a systems engineer take to discover how Palo Alto Networks can bring value to a customer’s business when they show interest in adopting Zero Trust? (Choose two.)
- A . Ask the customer about their internal business flows, such as how their users interact with applications and data across the infrastructure.
- B . Explain how Palo Alto Networks can place virtual NGFWs across the customer’s network to ensure assets and traffic are seen and controlled.
- C . Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto Networks capabilities are in meeting Zero Trust.
- D . Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it is something they purchase.
Correct Answer: A, D
A, D
Explanation:
To help a customer understand how Palo Alto Networks can bring value when adopting a Zero Trust architecture, the systems engineer must focus on understanding the customer’s specific needs and explaining how the Zero Trust strategy aligns with their business goals.
Here’s the detailed analysis of each option:
Option A: Ask the customer about their internal business flows, such as how their users interact with applications and data across the infrastructure
Understanding the customer’s internal workflows and how their users interact with applications and
data is a critical first step in Zero Trust. This information allows the systems engineer to identify potential security gaps and suggest tailored solutions.
This is correct.
Option B: Explain how Palo Alto Networks can place virtual NGFWs across the customer’s network to ensure assets and traffic are seen and controlled
While placing NGFWs across the customer’s network may be part of the implementation, this approach focuses on the product rather than the customer’s strategy. Zero Trust is more about policies and architecture than specific product placement.
This is incorrect.
Option C: Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto Networks capabilities are in meeting Zero Trust
While demonstrating capabilities is valuable during the later stages of engagement, the initial focus should be on understanding the customer’s business requirements rather than showcasing products.
This is incorrect.
Option D: Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it is something they purchase
Zero Trust is not a product but a strategy that requires a shift in mindset. By discussing their approach, the systems engineer can identify whether the customer understands Zero Trust principles and guide them accordingly.
This is correct.
Reference: Palo Alto Networks documentation on Zero Trust
Zero Trust Architecture Principles in NIST 800-207
A, D
Explanation:
To help a customer understand how Palo Alto Networks can bring value when adopting a Zero Trust architecture, the systems engineer must focus on understanding the customer’s specific needs and explaining how the Zero Trust strategy aligns with their business goals.
Here’s the detailed analysis of each option:
Option A: Ask the customer about their internal business flows, such as how their users interact with applications and data across the infrastructure
Understanding the customer’s internal workflows and how their users interact with applications and
data is a critical first step in Zero Trust. This information allows the systems engineer to identify potential security gaps and suggest tailored solutions.
This is correct.
Option B: Explain how Palo Alto Networks can place virtual NGFWs across the customer’s network to ensure assets and traffic are seen and controlled
While placing NGFWs across the customer’s network may be part of the implementation, this approach focuses on the product rather than the customer’s strategy. Zero Trust is more about policies and architecture than specific product placement.
This is incorrect.
Option C: Use the Zero Trust Roadshow package to demonstrate to the customer how robust Palo Alto Networks capabilities are in meeting Zero Trust
While demonstrating capabilities is valuable during the later stages of engagement, the initial focus should be on understanding the customer’s business requirements rather than showcasing products.
This is incorrect.
Option D: Ask the customer about their approach to Zero Trust, explaining that it is a strategy more than it is something they purchase
Zero Trust is not a product but a strategy that requires a shift in mindset. By discussing their approach, the systems engineer can identify whether the customer understands Zero Trust principles and guide them accordingly.
This is correct.
Reference: Palo Alto Networks documentation on Zero Trust
Zero Trust Architecture Principles in NIST 800-207
Question #25
A company has multiple business units, each of which manages its own user directories and identity providers (IdPs) with different domain names. The company’s network security team wants to deploy a shared GlobalProtect remote access service for all business units to authenticate users to each business unit’s IdP.
Which configuration will enable the network security team to authenticate GlobalProtect users to multiple SAML IdPs?
- A . GlobalProtect with multiple authentication profiles for each SAML IdP
- B . Multiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect portals and gateways
- C . Authentication sequence that has multiple authentication profiles using different authentication methods
- D . Multiple Cloud Identity Engine tenants for each business unit
Correct Answer: A
A
Explanation:
To configure GlobalProtect to authenticate users from multiple SAML identity providers (IdPs), the correct approach involves creating multiple authentication profiles, one for each IdP. Here’s the analysis of each option:
Option A: GlobalProtect with multiple authentication profiles for each SAML IdP
GlobalProtect allows configuring multiple SAML authentication profiles, each corresponding to a specific IdP.
These profiles are associated with the GlobalProtect portal or gateway. When users attempt to authenticate, they can be directed to the appropriate IdP based on their domain or other attributes.
This is the correct approach to enable authentication for users from multiple IdPs.
Option B: Multiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect portals and gateways
The Cloud Identity Engine (CIE) can synchronize identities from multiple directories, but it does not directly support multiple SAML IdPs for a shared GlobalProtect setup.
This option is not applicable.
Option C: Authentication sequence that has multiple authentication profiles using different
authentication methods
Authentication sequences allow multiple authentication methods (e.g., LDAP, RADIUS, SAML) to be tried in sequence for the same user, but they are not designed for handling multiple SAML IdPs.
This option is not appropriate for the scenario.
Option D: Multiple Cloud Identity Engine tenants for each business unit
Deploying multiple CIE tenants for each business unit adds unnecessary complexity and is not required for configuring GlobalProtect to authenticate users to multiple SAML IdPs.
This option is not appropriate.
A
Explanation:
To configure GlobalProtect to authenticate users from multiple SAML identity providers (IdPs), the correct approach involves creating multiple authentication profiles, one for each IdP. Here’s the analysis of each option:
Option A: GlobalProtect with multiple authentication profiles for each SAML IdP
GlobalProtect allows configuring multiple SAML authentication profiles, each corresponding to a specific IdP.
These profiles are associated with the GlobalProtect portal or gateway. When users attempt to authenticate, they can be directed to the appropriate IdP based on their domain or other attributes.
This is the correct approach to enable authentication for users from multiple IdPs.
Option B: Multiple authentication mode Cloud Identity Engine authentication profile for use on the GlobalProtect portals and gateways
The Cloud Identity Engine (CIE) can synchronize identities from multiple directories, but it does not directly support multiple SAML IdPs for a shared GlobalProtect setup.
This option is not applicable.
Option C: Authentication sequence that has multiple authentication profiles using different
authentication methods
Authentication sequences allow multiple authentication methods (e.g., LDAP, RADIUS, SAML) to be tried in sequence for the same user, but they are not designed for handling multiple SAML IdPs.
This option is not appropriate for the scenario.
Option D: Multiple Cloud Identity Engine tenants for each business unit
Deploying multiple CIE tenants for each business unit adds unnecessary complexity and is not required for configuring GlobalProtect to authenticate users to multiple SAML IdPs.
This option is not appropriate.
Question #26
A customer claims that Advanced WildFire miscategorized a file as malicious and wants proof, because another vendor has said that the file is benign.
How could the systems engineer assure the customer that Advanced WildFire was accurate?
- A . Review the threat logs for information to provide to the customer.
- B . Use the WildFire Analysis Report in the log to show the customer the malicious actions the file took when it was detonated.
- C . Open a TAG ticket for the customer and allow support engineers to determine the appropriate action.
- D . Do nothing because the customer will realize Advanced WildFire is right.
Correct Answer: B
B
Explanation:
Advanced WildFire is Palo Alto Networks’ cloud-based malware analysis and prevention solution. It determines whether files are malicious by executing them in a sandbox environment and observing their behavior. To address the customer’s concern about the file categorization, the systems engineer must provide evidence of the file’s behavior.
Here’s the analysis of each option:
Option A: Review the threat logs for information to provide to the customer
Threat logs can provide a summary of events and verdicts for malicious files, but they do not include the detailed behavior analysis needed to convince the customer.
While reviewing the logs is helpful as a preliminary step, it does not provide the level of proof the customer needs.
This option is not sufficient on its own.
Option B: Use the WildFire Analysis Report in the log to show the customer the malicious actions the file took when it was detonated
WildFire generates an analysis report that includes details about the file’s behavior during detonation in the sandbox, such as network activity, file modifications, process executions, and any indicators of compromise (IoCs).
This report provides concrete evidence to demonstrate why the file was flagged as malicious. It is the most accurate way to assure the customer that WildFire’s decision was based on observed malicious actions.
This is the best option.
Option C: Open a TAG ticket for the customer and allow support engineers to determine the appropriate action
While opening a support ticket is a valid action for further analysis or appeal, it is not a direct way to assure the customer of the current WildFire verdict.
This option does not directly address the customer’s request for immediate proof.
This option is not ideal.
Option D: Do nothing because the customer will realize Advanced WildFire is right
This approach is dismissive of the customer’s concerns and does not provide any evidence to support WildFire’s decision.
This option is inappropriate.
Reference: Palo Alto Networks documentation on WildFire
WildFire Analysis Reports
B
Explanation:
Advanced WildFire is Palo Alto Networks’ cloud-based malware analysis and prevention solution. It determines whether files are malicious by executing them in a sandbox environment and observing their behavior. To address the customer’s concern about the file categorization, the systems engineer must provide evidence of the file’s behavior.
Here’s the analysis of each option:
Option A: Review the threat logs for information to provide to the customer
Threat logs can provide a summary of events and verdicts for malicious files, but they do not include the detailed behavior analysis needed to convince the customer.
While reviewing the logs is helpful as a preliminary step, it does not provide the level of proof the customer needs.
This option is not sufficient on its own.
Option B: Use the WildFire Analysis Report in the log to show the customer the malicious actions the file took when it was detonated
WildFire generates an analysis report that includes details about the file’s behavior during detonation in the sandbox, such as network activity, file modifications, process executions, and any indicators of compromise (IoCs).
This report provides concrete evidence to demonstrate why the file was flagged as malicious. It is the most accurate way to assure the customer that WildFire’s decision was based on observed malicious actions.
This is the best option.
Option C: Open a TAG ticket for the customer and allow support engineers to determine the appropriate action
While opening a support ticket is a valid action for further analysis or appeal, it is not a direct way to assure the customer of the current WildFire verdict.
This option does not directly address the customer’s request for immediate proof.
This option is not ideal.
Option D: Do nothing because the customer will realize Advanced WildFire is right
This approach is dismissive of the customer’s concerns and does not provide any evidence to support WildFire’s decision.
This option is inappropriate.
Reference: Palo Alto Networks documentation on WildFire
WildFire Analysis Reports
Question #27
According to a customer’s CIO, who is upgrading PAN-OS versions, “Finding issues and then engaging with your support people requires expertise that our operations team can better utilize elsewhere on more valuable tasks for the business.” The upgrade project was initiated in a rush because the company did not have the appropriate tools to indicate that their current NGFWs were reaching capacity.
Which two actions by the Palo Alto Networks team offer a long-term solution for the customer? (Choose two.)
- A . Recommend that the operations team use the free machine learning-powered AIOps for NGFW tool.
- B . Suggest the inclusion of training into the proposal so that the operations team is informed and confident in working on their firewalls.
- C . Inform the CIO that the new enhanced security features they will gain from the PAN-OS upgrades will fix any future problems with upgrading and capacity.
- D . Propose AIOps Premium within Strata Cloud Manager (SCM) to address the company’s issues from within the existing technology.
Correct Answer: A, D
A, D
Explanation:
Free AIOps for NGFW Tool (Answer A):
The free AIOps for NGFW tool uses machine learning-powered analytics to monitor firewall performance, detect potential capacity issues, and provide insights for proactive management.
This tool helps operations teams identify capacity thresholds, performance bottlenecks, and configuration issues, reducing the reliance on manual expertise for routine tasks.
By using AIOps, the customer can avoid rushed upgrade projects in the future, as the tool provides predictive insights and recommendations for capacity planning.
AIOps Premium within Strata Cloud Manager (Answer D):
AIOps Premium is a paid version available within Strata Cloud Manager (SCM), offering more advanced analytics and proactive monitoring capabilities.
It helps address operational challenges by automating workflows and ensuring the health and performance of NGFWs, minimizing the need for constant manual intervention.
This aligns with the CIO’s goal of freeing up the operations team for more valuable business tasks.
Why Not B:
While training may help the operations team gain confidence, the long-term focus should be on reducing their manual workload by providing automated tools like AIOps. The CIO’s concern indicates that relying on manual expertise for ongoing maintenance is not a scalable solution.
Why Not C:
Simply informing the CIO about enhanced features from a PAN-OS upgrade does not address the capacity planning issues or reduce the dependency on the operations team for manual issue resolution.
Reference from Palo Alto Networks Documentation:
AIOps for NGFW Overview
Strata Cloud Manager and AIOps Integration
A, D
Explanation:
Free AIOps for NGFW Tool (Answer A):
The free AIOps for NGFW tool uses machine learning-powered analytics to monitor firewall performance, detect potential capacity issues, and provide insights for proactive management.
This tool helps operations teams identify capacity thresholds, performance bottlenecks, and configuration issues, reducing the reliance on manual expertise for routine tasks.
By using AIOps, the customer can avoid rushed upgrade projects in the future, as the tool provides predictive insights and recommendations for capacity planning.
AIOps Premium within Strata Cloud Manager (Answer D):
AIOps Premium is a paid version available within Strata Cloud Manager (SCM), offering more advanced analytics and proactive monitoring capabilities.
It helps address operational challenges by automating workflows and ensuring the health and performance of NGFWs, minimizing the need for constant manual intervention.
This aligns with the CIO’s goal of freeing up the operations team for more valuable business tasks.
Why Not B:
While training may help the operations team gain confidence, the long-term focus should be on reducing their manual workload by providing automated tools like AIOps. The CIO’s concern indicates that relying on manual expertise for ongoing maintenance is not a scalable solution.
Why Not C:
Simply informing the CIO about enhanced features from a PAN-OS upgrade does not address the capacity planning issues or reduce the dependency on the operations team for manual issue resolution.
Reference from Palo Alto Networks Documentation:
AIOps for NGFW Overview
Strata Cloud Manager and AIOps Integration
Question #28
In addition to DNS Security, which three Cloud-Delivered Security Services (CDSS) subscriptions are minimum recommendations for all NGFWs that handle north-south traffic? (Choose three)
- A . SaaS Security
- B . Advanced WildFire
- C . Enterprise DLP
- D . Advanced Threat Prevention
- E . Advanced URL Filtering
Correct Answer: B, D, E
B, D, E
Explanation:
North-south traffic refers to the flow of data in and out of a network, typically between internal resources and the internet. To secure this type of traffic, Palo Alto Networks recommends specific CDSS subscriptions in addition to DNS Security:
B, D, E
Explanation:
North-south traffic refers to the flow of data in and out of a network, typically between internal resources and the internet. To secure this type of traffic, Palo Alto Networks recommends specific CDSS subscriptions in addition to DNS Security:
Question #29
A company with Palo Alto Networks NGFWs protecting its physical data center servers is experiencing a performance issue on its Active Directory (AD) servers due to high numbers of requests and updates the NGFWs are placing on the servers.
How can the NGFWs be enabled to efficiently identify users without overloading the AD servers?
- A . Configure Cloud Identity Engine to learn the users’ IP address-user mappings from the AD authentication logs.
- B . Configure an NGFW as a GlobalProtect gateway, then have all users run GlobalProtect Windows SSO to gather user information.
- C . Configure data redistribution to redistribute IP address-user mappings from a hub NGFW to the other spoke NGFWs.
- D . Configure an NGFW as a GlobalProtect gateway, then have all users run GlobalProtect agents to gather user information.
Correct Answer: A
A
Explanation:
When high traffic from Palo Alto Networks NGFWs to Active Directory servers causes performance issues, optimizing the way NGFWs gather user-to-IP mappings is critical. Palo Alto Networks offers multiple ways to collect user identity information, and Cloud Identity Engine provides a solution that reduces the load on AD servers while still ensuring efficient and accurate mapping.
Option A (Correct): Cloud Identity Engine allows NGFWs to gather user-to-IP mappings directly from Active Directory authentication logs or other identity sources without placing heavy traffic on the AD servers. By leveraging this feature, the NGFW can offload authentication-related tasks and efficiently identify users without overloading AD servers. This solution is scalable and minimizes the overhead typically caused by frequent User-ID queries to AD servers.
Option B: Using GlobalProtect Windows SSO to gather user information can add complexity and is not the most efficient solution for this problem. It requires all users to install GlobalProtect agents, which may not be feasible in all environments and can introduce operational challenges.
Option C: Data redistribution involves redistributing user-to-IP mappings from one NGFW (hub) to other NGFWs (spokes). While this can reduce the number of queries sent to AD servers, it assumes the mappings are already being collected from AD servers by the hub, which means the performance issue on the AD servers would persist.
Option D: Using GlobalProtect agents to gather user information is a valid method for environments where GlobalProtect is already deployed, but it is not the most efficient or straightforward solution for the given problem. It also introduces dependencies on agent deployment, configuration, and management.
How to Implement Cloud Identity Engine for User-ID Mapping:
Enable Cloud Identity Engine from the Palo Alto Networks console.
Integrate the Cloud Identity Engine with the AD servers to allow it to retrieve authentication logs directly.
Configure the NGFWs to use the Cloud Identity Engine for User-ID mappings instead of querying the AD servers directly.
Monitor performance to ensure the AD servers are no longer overloaded, and mappings are being retrieved efficiently.
Reference: Cloud Identity Engine Overview: https://docs.paloaltonetworks.com/cloud-identity
User-ID Best Practices: https://docs.paloaltonetworks.com
A
Explanation:
When high traffic from Palo Alto Networks NGFWs to Active Directory servers causes performance issues, optimizing the way NGFWs gather user-to-IP mappings is critical. Palo Alto Networks offers multiple ways to collect user identity information, and Cloud Identity Engine provides a solution that reduces the load on AD servers while still ensuring efficient and accurate mapping.
Option A (Correct): Cloud Identity Engine allows NGFWs to gather user-to-IP mappings directly from Active Directory authentication logs or other identity sources without placing heavy traffic on the AD servers. By leveraging this feature, the NGFW can offload authentication-related tasks and efficiently identify users without overloading AD servers. This solution is scalable and minimizes the overhead typically caused by frequent User-ID queries to AD servers.
Option B: Using GlobalProtect Windows SSO to gather user information can add complexity and is not the most efficient solution for this problem. It requires all users to install GlobalProtect agents, which may not be feasible in all environments and can introduce operational challenges.
Option C: Data redistribution involves redistributing user-to-IP mappings from one NGFW (hub) to other NGFWs (spokes). While this can reduce the number of queries sent to AD servers, it assumes the mappings are already being collected from AD servers by the hub, which means the performance issue on the AD servers would persist.
Option D: Using GlobalProtect agents to gather user information is a valid method for environments where GlobalProtect is already deployed, but it is not the most efficient or straightforward solution for the given problem. It also introduces dependencies on agent deployment, configuration, and management.
How to Implement Cloud Identity Engine for User-ID Mapping:
Enable Cloud Identity Engine from the Palo Alto Networks console.
Integrate the Cloud Identity Engine with the AD servers to allow it to retrieve authentication logs directly.
Configure the NGFWs to use the Cloud Identity Engine for User-ID mappings instead of querying the AD servers directly.
Monitor performance to ensure the AD servers are no longer overloaded, and mappings are being retrieved efficiently.
Reference: Cloud Identity Engine Overview: https://docs.paloaltonetworks.com/cloud-identity
User-ID Best Practices: https://docs.paloaltonetworks.com
Question #30
Which two compliance frameworks are included with the Premium version of Strata Cloud Manager (SCM)? (Choose two)
- A . Payment Card Industry (PCI)
- B . National Institute of Standards and Technology (NIST)
- C . Center for Internet Security (CIS)
- D . Health Insurance Portability and Accountability Act (HIPAA)
Correct Answer: A, C
A, C
Explanation:
Strata Cloud Manager (SCM), part of Palo Alto Networks’ Prisma Access and Prisma SD-WAN suite, provides enhanced visibility and control for managing compliance and security policies across the network. In the Premium version of SCM, compliance frameworks are pre-integrated to help organizations streamline audits and maintain adherence to critical standards.
A, C
Explanation:
Strata Cloud Manager (SCM), part of Palo Alto Networks’ Prisma Access and Prisma SD-WAN suite, provides enhanced visibility and control for managing compliance and security policies across the network. In the Premium version of SCM, compliance frameworks are pre-integrated to help organizations streamline audits and maintain adherence to critical standards.