Font size
WorksheetsLab exercises User-ID
Total questions: 12
Worksheet time: 24mins
Your company requires positive username attribution of every IP address used by wireless devices to support a new compliance requirement. You must collect IP-to-user mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufactures.
Given the scenario, choose the option for sending IP-to-user mappings to the NGFW.
syslog
RADIUS
UID redistribution
XFF headers
Identify the correct order to configure the PAN-OS integrated USER-ID agent.
A. create a service account on the Domain Controller with sufficient permissions to execute the User- ID agent
B. add the service account to monitor the server(s)
C. define the address of the servers to be monitored on the firewall
D. commit the configuration, and verify agent connection status
A-B-C-D
A-C-B-D
C-A-B-D
B-A-C-D
Which protocol used to map username to user groups when user-ID is configured?
RADIUS
LDAP
TACACS+
SAML
Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall’s management plane is only slightly utilized.
Which User-ID agent is sufficient in your network?
Windows-based agent deployed on each domain controller
PAN-OS integrated agent deployed on the firewall
Citrix terminal server agent deployed on the network
Windows-based agent deployed on the internal network a domain member
Which User-ID IP address-to-username mapping method can require user interaction?
Captive Portal
monitoring Active Directory event logs
monitoring print server event logs
monitoring a Cisco WLAN controller
Which source of user information is not supported by the NGFW?
RACF
LDAP
Active Directory
SAML
Which User-ID mapping method should be used for an environment with users that do not authenticate to Active Directory?
Windows session monitoring
Captive Portal
passive server monitoring using the Windows-based agent
passive server monitoring using a PAN-OS integrated User-ID agent
Which feature can provide NGFWs with User-ID mapping information?
Web Captcha
Native 802.1q authentication
GlobalProtect
Native 802.1x authentication
Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?
syslog listening
XFF Headers
client probing
port mapping
Which User-ID method should be configured to map IP addresses to usernames for users connected through a terminal server?
port mapping
server monitoring
client probing
XFF headers
Your company has 10 Active Directory domain controllers spread across multiple WAN links. All users authenticate to Active Directory. Each link has substantial network bandwidth to support all mission-critical applications. The firewall's management plane is highly utilized.
Given the scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?
Captive Portal
Citrix terminal server agent with adequate data-plane resources
Windows-based agent
PAN-OS integrated agent
What are three considerations when deploying User-ID? (Choose three.)
Specify included and excluded networks when configuring User-ID
Only enable User-ID on trusted zones
Use a dedicated service account for User-ID services with the minimal permissions necessary
User-ID can support a maximum of 15 hops
Enable WMI probing in high security networks
