Lab exercises User-ID

Your company requires positive username attribution of every IP address used by wireless devices to support a new compliance requirement. You must collect IP-to-user mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufactures.

Given the scenario, choose the option for sending IP-to-user mappings to the NGFW.

• syslog

• RADIUS

• UID redistribution

• XFF headers

Answer explanation

Configure User-ID to Monitor Syslog Senders for User Mappin... (paloaltonetworks.com)

Identify the correct order to configure the PAN-OS integrated USER-ID agent.

A. create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent

B. add the service account to monitor the server(s)

C. define the address of the servers to be monitored on the firewall

D. commit the configuration, and verify agent connection status

• A-B-C-D

• A-C-B-D

• C-A-B-D

• B-A-C-D

Which protocol used to map username to user groups when user-ID is configured?

• RADIUS

• LDAP

• TACACS+

• SAML

Answer explanation

Map Users to Groups (paloaltonetworks.com)

Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall’s management plane is only slightly utilized.

Which User-ID agent is sufficient in your network?

• Windows-based agent deployed on each domain controller

• PAN-OS integrated agent deployed on the firewall

• Citrix terminal server agent deployed on the network

• Windows-based agent deployed on the internal network a domain member

Which User-ID IP address-to-username mapping method can require user interaction?

• Captive Portal

• monitoring Active Directory event logs

• monitoring print server event logs

• monitoring a Cisco WLAN controller

Which source of user information is not supported by the NGFW?

• RACF

• LDAP

• Active Directory

• SAML

Which User-ID mapping method should be used for an environment with users that do not authenticate to Active Directory?

• Windows session monitoring

• Captive Portal

• passive server monitoring using the Windows-based agent

• passive server monitoring using a PAN-OS integrated User-ID agent

Which feature can provide NGFWs with User-ID mapping information?

• Web Captcha

• Native 802.1q authentication

• GlobalProtect

• Native 802.1x authentication

Answer explanation

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/user-id-concepts/user-mapping

Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?

• syslog listening

• XFF Headers

• client probing

• port mapping

Answer explanation

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/user-id-concepts/user-mapping/xff-headers

Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?

• port mapping

• server monitoring

• client probing

• XFF headers

Answer explanation

Configure User Mapping for Terminal Server Users (paloaltonetworks.com)