ExamTopics Logo
Mail Us[email protected]
Menu
Palo-Alto-Networks Discussions
exam questions

Exam PCNSE All Questions

View all questions & answers for the PCNSE exam
Go to Exam

Exam PCNSE topic 1 question 267 discussion

Actual exam question from Palo Alto Networks's PCNSE
Question #: 267
Topic #: 1
[All PCNSE Questions]

Your company has 10 Active Directory domain controllers spread across multiple WAN links. All users authenticate to Active Directory. Each link has substantial network bandwidth to support all mission-critical applications. The firewall's management plane is highly utilized. Given this scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?

  • A. PAN-OS integrated agent
  • B. Citrix terminal server agent with adequate data-plane resources
  • C. Captive Portal
  • D. Windows-based User-ID agent on a standalone server
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by TAKUM1y at Oct. 22, 2022, 3:39 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
avator
1 year ago
Selected Answer: D Which Agent Type is Better? The result is that, in an infrastructure with remote networks separated by WAN links, the integrated agent is more appropriate for reading remote logs and the Windows-based agent is more appropriate for reading local logs. However, use of the integrated agent is not without cost: It consumes more of the firewall’s management plane resources. For this reason, deployment of the Windows agent at remote sites and having them forward the relevant User-ID information to a firewall on a central network often is beneficial. https://beacon.paloaltonetworks.com/uploads/resource_courses
upvoted 1 times
...
Whizdhum
1 year, 1 month ago
Answer is D. The way you configure the User-ID agent depends on the size of your environment and the location of your domain servers. As a best practice, locate your User-ID agents near the servers it will monitor (that is, the monitored servers and the Windows User-ID agent should not be across a WAN link from each other).
upvoted 1 times
...
DenskyDen
1 year, 11 months ago
D. Read TAKUM1y link.
upvoted 1 times
...
TAKUM1y
2 years, 3 months ago
Selected Answer: D
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel