Palo Alto Networks Certified Network Security Administrator Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  I spottet for 'A' and seeing the discussion between A or D I still go for 'A' for the following reasons. The question is not mentioning that is a remote site, just a network that have 2 slow wan links and few resources on the management plane. So as say only a network in the question, the 'D' deploying agents on the wan sites does not fit because wan links are slow. and also no mentioning if across wan links could be the remote site or main site, so I think D would not fit the question. But answer A Windows-based agent deployed on the internal network, would fit better on it because the key phrase here is "internal network" that may refer that the network mentioned main site where servers could be stored. user based agent is best practice to locate the agent near the servers to be monitored, so make much sense on A as an answer

• 2

  This question is actually quoted from EDU-210 book. Here I quote the statement from User_ID (Module 10). "In an infrastructure with remote networks separated by WAN links, the integrated agent is more appropriate for reading remote logs and the Windows-based agent is more appropriate for reading local logs. However, use of the integrated agent is not without cost: It consumes more of the firewall's management plane resources. For this reason, deployment of the Windows agent at the remote sites and having the forward the relevant User-ID information to a firewall on a central network often is beneficial.

• Chose D1

  From PAN-OS Admin guide: "As a best practice, locate your User-ID agents near the servers it will monitor (that is, the monitored servers and the Windows User-ID agent should not be across a WAN link from each other). This is because most of the traffic for user mapping occurs between the agent and the monitored server, with only a small amount of traffic—the delta of user mappings since the last update—from the agent to the firewall." This suggests D is the correct answer.