Palo Alto Networks NGFW-Engineer Practice Test 18
Question 170
A validated firewall incident has this root condition: Regional firewalls cannot use mappings learned by a central trusted firewall and the same clients become unknown users. Which targeted PAN-OS configuration directly addresses the requirement to redistribute approved identity mapping data across trusted segments?
- Restrict User-ID source collection and redistribution to trusted agents and interfaces.
- Use the supported terminal-server mapping mechanism appropriate to the environment.
- Tune supported mapping timeout and logoff integration for the observed workstation behavior.
- Configure supported User-ID redistribution between the authorized mapping sources and consumers.
Explanation
Correct Answer
D:Configure supported User-ID redistribution between the authorized mapping sources and consumers. Identity redistribution shares user context only through configured trusted channels. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Restrict User-ID source collection and redistribution to trusted agents and interfaces. This configuration is intended to accept identity mappings only from trusted approved sources, not to redistribute approved identity mapping data across trusted segments. Changing this adjacent capability would leave the stated user-id redistribution requirement unresolved.
B:Use the supported terminal-server mapping mechanism appropriate to the environment. This configuration is intended to distinguish user sessions that share a network source address, not to redistribute approved identity mapping data across trusted segments. Changing this adjacent capability would leave the stated user-id redistribution requirement unresolved.
C:Tune supported mapping timeout and logoff integration for the observed workstation behavior. This configuration is intended to expire stale identities and refresh mappings promptly, not to redistribute approved identity mapping data across trusted segments. Changing this adjacent capability would leave the stated user-id redistribution requirement unresolved.
Question 171
The team has confirmed its user-id source trust boundary fault: A public-facing segment sends user mapping events that administrators do not recognize as authoritative. What configuration should it select to accept identity mappings only from trusted approved sources?
- Use the supported terminal-server mapping mechanism appropriate to the environment.
- Configure a supported authentication portal policy and appropriate guest identity method.
- Restrict User-ID source collection and redistribution to trusted agents and interfaces.
- Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds.
Explanation
Correct Answer
C:Restrict User-ID source collection and redistribution to trusted agents and interfaces. User-to-IP mapping becomes a security input and should not be accepted indiscriminately. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Use the supported terminal-server mapping mechanism appropriate to the environment. This configuration is intended to distinguish user sessions that share a network source address, not to accept identity mappings only from trusted approved sources. Changing this adjacent capability would leave the stated user-id source trust boundary requirement unresolved.
B:Configure a supported authentication portal policy and appropriate guest identity method. This configuration is intended to obtain authenticated identity context before granting a user-based guest flow, not to accept identity mappings only from trusted approved sources. Changing this adjacent capability would leave the stated user-id source trust boundary requirement unresolved.
D:Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds. This configuration is intended to associate the right authenticated username with current client IP addresses, not to accept identity mappings only from trusted approved sources. Changing this adjacent capability would leave the stated user-id source trust boundary requirement unresolved.
Question 172
The engineer has finished diagnosis and must choose an enforceable change. Many remote desktop users share the same server IP and user-based rules select an incorrect individual. Which implementation best meets the need to distinguish user sessions that share a network source address?
- Configure a supported authentication portal policy and appropriate guest identity method.
- Use the supported terminal-server mapping mechanism appropriate to the environment.
- Tune supported mapping timeout and logoff integration for the observed workstation behavior.
- Configure or repair supported group mapping from the authoritative directory.
Explanation
Correct Answer
B:Use the supported terminal-server mapping mechanism appropriate to the environment. Ordinary one-IP-to-one-user assumptions can fail when many users share the same source host. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure a supported authentication portal policy and appropriate guest identity method. This configuration is intended to obtain authenticated identity context before granting a user-based guest flow, not to distinguish user sessions that share a network source address. Changing this adjacent capability would leave the stated terminal server user mapping requirement unresolved.
C:Tune supported mapping timeout and logoff integration for the observed workstation behavior. This configuration is intended to expire stale identities and refresh mappings promptly, not to distinguish user sessions that share a network source address. Changing this adjacent capability would leave the stated terminal server user mapping requirement unresolved.
D:Configure or repair supported group mapping from the authoritative directory. This configuration is intended to refresh group membership information for policy decisions, not to distinguish user sessions that share a network source address. Changing this adjacent capability would leave the stated terminal server user mapping requirement unresolved.
Question 173
An approved design change is required after engineers establish: Guest clients have no reliable directory login event but a zone-specific policy requires known users. Which control directly enables the organization to obtain authenticated identity context before granting a user-based guest flow?
- Configure a supported authentication portal policy and appropriate guest identity method.
- Tune supported mapping timeout and logoff integration for the observed workstation behavior.
- Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds.
- Configure the correct Cloud Identity Engine tenant integration and supported group synchronization.
Explanation
Correct Answer
A:Configure a supported authentication portal policy and appropriate guest identity method. An authentication portal can supply user context for clients lacking passive identity mappings. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Tune supported mapping timeout and logoff integration for the observed workstation behavior. This configuration is intended to expire stale identities and refresh mappings promptly, not to obtain authenticated identity context before granting a user-based guest flow. Changing this adjacent capability would leave the stated captive portal user identification requirement unresolved.
C:Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds. This configuration is intended to associate the right authenticated username with current client IP addresses, not to obtain authenticated identity context before granting a user-based guest flow. Changing this adjacent capability would leave the stated captive portal user identification requirement unresolved.
D:Configure the correct Cloud Identity Engine tenant integration and supported group synchronization. This configuration is intended to deliver current cloud group context into supported identity policy, not to obtain authenticated identity context before granting a user-based guest flow. Changing this adjacent capability would leave the stated captive portal user identification requirement unresolved.
Question 174
A validated firewall incident has this root condition: Shared workstation usernames linger in security logs after one operator signs out and another signs in. Which targeted PAN-OS configuration directly addresses the requirement to expire stale identities and refresh mappings promptly?
- Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds.
- Configure or repair supported group mapping from the authoritative directory.
- Configure supported User-ID redistribution between the authorized mapping sources and consumers.
- Tune supported mapping timeout and logoff integration for the observed workstation behavior.
Explanation
Correct Answer
D:Tune supported mapping timeout and logoff integration for the observed workstation behavior. Stale user-to-IP mappings can misattribute a shared host after user change. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds. This configuration is intended to associate the right authenticated username with current client IP addresses, not to expire stale identities and refresh mappings promptly. Changing this adjacent capability would leave the stated identity mapping timeout requirement unresolved.
B:Configure or repair supported group mapping from the authoritative directory. This configuration is intended to refresh group membership information for policy decisions, not to expire stale identities and refresh mappings promptly. Changing this adjacent capability would leave the stated identity mapping timeout requirement unresolved.
C:Configure supported User-ID redistribution between the authorized mapping sources and consumers. This configuration is intended to redistribute approved identity mapping data across trusted segments, not to expire stale identities and refresh mappings promptly. Changing this adjacent capability would leave the stated identity mapping timeout requirement unresolved.
Question 175
The team has confirmed its explicit web proxy routing fault: A managed browser must send web requests through PAN-OS proxy but its configuration points directly to the origin. What configuration should it select to ensure approved client web requests reach the intended proxy listener?
- Enable the supported proxy authentication method and assign identity-aware access policy.
- Replace the broad bypass with documented host or address exceptions.
- Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients.
- Create or move a precise category-based deny policy above the broad rule.
Explanation
Correct Answer
C:Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients. Explicit web proxy requires the client to direct requests to the configured proxy endpoint. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Enable the supported proxy authentication method and assign identity-aware access policy. This configuration is intended to apply user-aware web access decisions through the proxy, not to ensure approved client web requests reach the intended proxy listener. Changing this adjacent capability would leave the stated explicit web proxy routing requirement unresolved.
B:Replace the broad bypass with documented host or address exceptions. This configuration is intended to limit proxy exceptions to the narrowly approved destinations, not to ensure approved client web requests reach the intended proxy listener. Changing this adjacent capability would leave the stated explicit web proxy routing requirement unresolved.
D:Create or move a precise category-based deny policy above the broad rule. This configuration is intended to enforce the intended URL category restriction ahead of permissive rules, not to ensure approved client web requests reach the intended proxy listener. Changing this adjacent capability would leave the stated explicit web proxy routing requirement unresolved.
Question 176
The engineer has finished diagnosis and must choose an enforceable change. An office web proxy sees client requests but can associate them only with shared source IPs. Which implementation best meets the need to apply user-aware web access decisions through the proxy?
- Replace the broad bypass with documented host or address exceptions.
- Enable the supported proxy authentication method and assign identity-aware access policy.
- Correct the PAC destination and proxy listener settings for the affected users.
- Use the appropriate application-default service restriction for the approved app rule.
Explanation
Correct Answer
B:Enable the supported proxy authentication method and assign identity-aware access policy. Proxy authentication provides user identity when client IP alone is inadequate. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Replace the broad bypass with documented host or address exceptions. This configuration is intended to limit proxy exceptions to the narrowly approved destinations, not to apply user-aware web access decisions through the proxy. Changing this adjacent capability would leave the stated web proxy authentication identity requirement unresolved.
C:Correct the PAC destination and proxy listener settings for the affected users. This configuration is intended to restore application connectivity through the intended proxy path, not to apply user-aware web access decisions through the proxy. Changing this adjacent capability would leave the stated web proxy authentication identity requirement unresolved.
D:Use the appropriate application-default service restriction for the approved app rule. This configuration is intended to restrict allowed application traffic to its expected service ports, not to apply user-aware web access decisions through the proxy. Changing this adjacent capability would leave the stated web proxy authentication identity requirement unresolved.
Question 177
An approved design change is required after engineers establish: An application fails when proxied but the configured bypass list currently permits every private subnet. Which control directly enables the organization to limit proxy exceptions to the narrowly approved destinations?
- Replace the broad bypass with documented host or address exceptions.
- Correct the PAC destination and proxy listener settings for the affected users.
- Create or move a precise category-based deny policy above the broad rule.
- Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients.
Explanation
Correct Answer
A:Replace the broad bypass with documented host or address exceptions. Overbroad proxy bypass weakens monitoring for traffic that remains compatible with proxying. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Correct the PAC destination and proxy listener settings for the affected users. This configuration is intended to restore application connectivity through the intended proxy path, not to limit proxy exceptions to the narrowly approved destinations. Changing this adjacent capability would leave the stated web proxy bypass exceptions requirement unresolved.
C:Create or move a precise category-based deny policy above the broad rule. This configuration is intended to enforce the intended URL category restriction ahead of permissive rules, not to limit proxy exceptions to the narrowly approved destinations. Changing this adjacent capability would leave the stated web proxy bypass exceptions requirement unresolved.
D:Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients. This configuration is intended to ensure approved client web requests reach the intended proxy listener, not to limit proxy exceptions to the narrowly approved destinations. Changing this adjacent capability would leave the stated web proxy bypass exceptions requirement unresolved.
Question 178
A validated firewall incident has this root condition: An authenticated client repeatedly gets proxy errors after PAC changes even though direct internet access works. Which targeted PAN-OS configuration directly addresses the requirement to restore application connectivity through the intended proxy path?
- Create or move a precise category-based deny policy above the broad rule.
- Use the appropriate application-default service restriction for the approved app rule.
- Enable the supported proxy authentication method and assign identity-aware access policy.
- Correct the PAC destination and proxy listener settings for the affected users.
Explanation
Correct Answer
D:Correct the PAC destination and proxy listener settings for the affected users. The selected proxy endpoint must be reachable and authenticated before origin requests can succeed. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Create or move a precise category-based deny policy above the broad rule. This configuration is intended to enforce the intended URL category restriction ahead of permissive rules, not to restore application connectivity through the intended proxy path. Changing this adjacent capability would leave the stated web proxy session failure diagnosis requirement unresolved.
B:Use the appropriate application-default service restriction for the approved app rule. This configuration is intended to restrict allowed application traffic to its expected service ports, not to restore application connectivity through the intended proxy path. Changing this adjacent capability would leave the stated web proxy session failure diagnosis requirement unresolved.
C:Enable the supported proxy authentication method and assign identity-aware access policy. This configuration is intended to apply user-aware web access decisions through the proxy, not to restore application connectivity through the intended proxy path. Changing this adjacent capability would leave the stated web proxy session failure diagnosis requirement unresolved.
Question 179
The team has confirmed its policy-based url category filtering fault: The business requires blocking a high-risk website category but a broad allow rule matches first. What configuration should it select to enforce the intended URL category restriction ahead of permissive rules?
- Use the appropriate application-default service restriction for the approved app rule.
- Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients.
- Create or move a precise category-based deny policy above the broad rule.
- Replace the broad bypass with documented host or address exceptions.
Explanation
Correct Answer
C:Create or move a precise category-based deny policy above the broad rule. Rule evaluation order and URL category matching jointly determine enforcement. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Use the appropriate application-default service restriction for the approved app rule. This configuration is intended to restrict allowed application traffic to its expected service ports, not to enforce the intended URL category restriction ahead of permissive rules. Changing this adjacent capability would leave the stated policy-based url category filtering requirement unresolved.
B:Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients. This configuration is intended to ensure approved client web requests reach the intended proxy listener, not to enforce the intended URL category restriction ahead of permissive rules. Changing this adjacent capability would leave the stated policy-based url category filtering requirement unresolved.
D:Replace the broad bypass with documented host or address exceptions. This configuration is intended to limit proxy exceptions to the narrowly approved destinations, not to enforce the intended URL category restriction ahead of permissive rules. Changing this adjacent capability would leave the stated policy-based url category filtering requirement unresolved.
Question 180
The engineer has finished diagnosis and must choose an enforceable change. A permitted application has to use its known standard ports, but a rule accepts any service for that App-ID. Which implementation best meets the need to restrict allowed application traffic to its expected service ports?
- Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients.
- Use the appropriate application-default service restriction for the approved app rule.
- Enable the supported proxy authentication method and assign identity-aware access policy.
- Correct the PAC destination and proxy listener settings for the affected users.
Explanation
Correct Answer
B:Use the appropriate application-default service restriction for the approved app rule. App-ID and service matching are distinct policy conditions, and application-default narrows expected ports. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure a supported PAN-OS web proxy listener and distribute its proxy settings to clients. This configuration is intended to ensure approved client web requests reach the intended proxy listener, not to restrict allowed application traffic to its expected service ports. Changing this adjacent capability would leave the stated policy application service constraints requirement unresolved.
C:Enable the supported proxy authentication method and assign identity-aware access policy. This configuration is intended to apply user-aware web access decisions through the proxy, not to restrict allowed application traffic to its expected service ports. Changing this adjacent capability would leave the stated policy application service constraints requirement unresolved.
D:Correct the PAC destination and proxy listener settings for the affected users. This configuration is intended to restore application connectivity through the intended proxy path, not to restrict allowed application traffic to its expected service ports. Changing this adjacent capability would leave the stated policy application service constraints requirement unresolved.
