Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Network Security Engineer (PCNSE) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Answer is C. Configure the Directory Sync component of the Cloud Identity Engine to retrieve user and group information from your Active Directory (AD); then, configure Group Mapping Settings in your Mobile Users—GlobalProtect, Mobile Users—Explicit Proxy, or remote network deployment. Alternatively, you can enable username-to-user group mapping for mobile users and users at remote networks using an LDAP server profile. The Cloud Identity Engine doesn't auto-populate groups to Panorama, so a master device or Cloud Identity Engine and specify it during the Prisma Access configuration. This answer assumes that the LDAP profile option is not used - Cloud Identity Engine is preferred.
For Group Mapping in Prisma you need Directory Sync, Master Device is only optional, without it you need to specify the full distinguished name (DN) of the group. So none of the options are correct, but if I would need to pick I would go for C.
Both C & D are part of the requirements for Group-Based access on this document https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/configure-user-id-in-prisma-access STEP 2 refers to D "for Prisma Access Nodes to get group mapping" STEP 3 refers to C "For Panorama to get the list of groups" Note Both can be replaced with the Cloud Identity Engine "Recommended"