Exam PCNSE topic 1 question 573 discussion

Actual exam question from Palo Alto Networks's PCNSE

Question #: 573
Topic #: 1

A customer wants to deploy User-ID on a Palo Alto Networks NGFW with multiple vsys. One of the vsys will support a GlobalProtect portal and gateway. The customer uses Windows Active Directory for authentication.

What is the most operationally efficient way to redistribute the most accurate IP addresses to username mappings?

A. Deploy a PAN-OS integrated User-ID agent on each vsys
B. Deploy the GlobalProtect vsys as a User-ID data hub
C. Deploy a M-200 as a User-ID collector
D. Deploy Windows User-ID agents on each domain controller

Show Suggested Answer

Suggested Answer: B 🗳️

by Viriathus at Jan. 3, 2024, 10:21 a.m.

Comments

Submit Cancel

Marshpillowz

9 months ago

Selected Answer: B

I think B

upvoted 2 times

...

cx777o

10 months ago

Selected Answer: B

It might be B, since the most operationally efficient way would be to configure one User-ID hub on one vsys and distribute the User-ID Sources from there to the other vsys.

upvoted 3 times

...

franko_72

10 months ago

Note sure where Global protect comes in here but: B https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-network/share-user-id-mappings-across-vsys

upvoted 2 times

Pacheco

9 months ago

B Your doc is spot-on. As for the role of GP, since users need to authenticate to connect to the vpn, GP will collect ip-to-username info and report it back to the user-ID agent on the firewall.

upvoted 2 times

...

Viriathus

10 months ago

Selected Answer: B

"..most accurate IP addresses .."

upvoted 2 times

...

Exam PCNSE All Questions

View all questions & answers for the PCNSE exam

Exam PCNSE topic 1 question 573 discussion

Comments

Marshpillowz

cx777o

franko_72

Pacheco

Viriathus

SY0-701