Exam PCNSE topic 1 question 573 discussion

Actual exam question from Palo Alto Networks's PCNSE

Question #: 573
Topic #: 1

A customer wants to deploy User-ID on a Palo Alto Networks NGFW with multiple vsys. One of the vsys will support a GlobalProtect portal and gateway. The customer uses Windows Active Directory for authentication.

What is the most operationally efficient way to redistribute the most accurate IP addresses to username mappings?

A. Deploy a PAN-OS integrated User-ID agent on each vsys
B. Deploy the GlobalProtect vsys as a User-ID data hub
C. Deploy a M-200 as a User-ID collector
D. Deploy Windows User-ID agents on each domain controller

Show Suggested Answer

Suggested Answer: B 🗳️

by Viriathus at Jan. 3, 2024, 10:21 a.m.

Comments

Submit Cancel

Marshpillowz

10 months, 3 weeks ago

Selected Answer: B

I think B

upvoted 2 times

...

cx777o

11 months, 3 weeks ago

Selected Answer: B

It might be B, since the most operationally efficient way would be to configure one User-ID hub on one vsys and distribute the User-ID Sources from there to the other vsys.

upvoted 3 times

...

franko_72

11 months, 3 weeks ago

Note sure where Global protect comes in here but: B https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/share-user-id-mappings-across-vsys

upvoted 2 times

Pacheco

10 months, 3 weeks ago

B Your doc is spot-on. As for the role of GP, since users need to authenticate to connect to the vpn, GP will collect ip-to-username info and report it back to the user-ID agent on the firewall.

upvoted 2 times

...

Viriathus

11 months, 4 weeks ago

Selected Answer: B

"..most accurate IP addresses .."

upvoted 2 times

...