User-ID is a feature in PAN-OS that maps IP addresses to usernames by integrating with various

directory services (e.g., Active Directory). User-ID can be implemented through agents provided by

Palo Alto Networks. Here’s how each option applies:

Option A: Integrated agent

The integrated User-ID agent is built into PAN-OS and does not require an external agent installation.

It is configured directly on the firewall and integrates with directory services to retrieve user

information.

This is correct.

Option B: GlobalProtect agent

GlobalProtect is Palo Alto Networks' VPN solution and does not function as a User-ID agent. While it

can be used to authenticate users and provide visibility, it is not categorized as a User-ID agent.

This is incorrect.

Option C: Windows-based agent

The Windows-based User-ID agent is a standalone agent installed on a Windows server. It collects

user mapping information from directory services and sends it to the firewall.

This is correct.

Option D: Cloud Identity Engine (CIE)

The Cloud Identity Engine provides identity services in a cloud-native manner but is not a User-ID

agent. It synchronizes with identity providers like Azure AD and Okta.

This is incorrect.

Reference:

Palo Alto Networks documentation on User-ID

Knowledge Base article on User-ID Agent Options

To demonstrate compliance with Zero Trust principles, a systems engineer can leverage the rich

reporting and logging capabilities of Palo Alto Networks firewalls. The focus should be on creating

reports that align with the customer's Zero Trust strategy, providing detailed insights into policy

enforcement, user activity, and application usage.

Option A: Scheduling a pre-built PDF report does not offer the flexibility to align the report with the

customer’s specific Zero Trust plan. While useful for automated reporting, this option is too generic

for demonstrating Zero Trust compliance.

Option B (Correct): Custom reports in the "Monitor > Manage Custom Reports" tab allow the

customer to build tailored reports that align with their Zero Trust plan. These reports can include

granular details such as application usage, user activity, policy enforcement logs, and segmentation

compliance. This approach ensures the customer can present evidence directly related to their Zero

Trust implementation.

Option C: Using a third-party tool is unnecessary as Palo Alto Networks NGFWs already have built-in

capabilities to log, report, and demonstrate policy enforcement. This option adds complexity and

may not fully leverage the native capabilities of the NGFW.

Option D: The Application Command Center (ACC) is useful for visualizing traffic and historical data

but is not a reporting tool. While it can complement custom reports, it is not a substitute for

generating Zero Trust-specific compliance reports.

Reference:

Managing Reports in PAN-OS: https://docs.paloaltonetworks.com

Zero Trust Monitoring and Reporting Best Practices: https://www.paloaltonetworks.com/zero-trust

The customer is seeking centralized policy management to reduce human error while maintaining

compliance with their contractual obligations to AWS and Azure. Here's the evaluation of each

option:

Option A: Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual

appliance from their CSP's marketplace of choice to centrally manage the systems

Cloud NGFW is a fully managed Next-Generation Firewall service by Palo Alto Networks, offered in

AWS and Azure marketplaces. It integrates natively with the CSP infrastructure, making it a good fit

for customers with existing CSP agreements.

Panorama, Palo Alto Networks' centralized management solution, can be deployed as a virtual

appliance in the CSP marketplace of choice, enabling centralized policy management across all

NGFWs.

This option addresses the customer's need for centralized management while leveraging their

existing contracts with AWS and Azure.

This option is appropriate.

Option B: Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG

licensing Panorama deployment in their CSP of choice

This option suggests using Cloud NGFW in AWS but VM-Series firewalls in Azure. While VM-Series is

a flexible virtual firewall solution, it may not align with the customer’s stated preference for CSP-

managed services like Cloud NGFW.

This option introduces a mix of solutions that could complicate centralized management and reduce

operational efficiency.

This option is less appropriate.

Option C: VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of

either type: Palo Alto Networks provides a license

VM-Series firewalls are well-suited for cloud deployments but require more manual configuration

compared to Cloud NGFW.

Building a Panorama instance manually on a host increases operational overhead and does not

leverage the customer’s existing CSP marketplaces.

This option is less aligned with the customer's needs.

Option D: VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-

offer Panorama virtual appliance from their CSP’s marketplace of choice to centrally manage the

systems

This option introduces both VM-Series and CN-Series firewalls in both CSPs. While CN-Series firewalls

are designed for Kubernetes environments, they may not be relevant if the customer does not

specifically require container-level security.

Adding CN-Series firewalls may introduce unnecessary complexity and costs.

This option is not appropriate.

Reference:

Palo Alto Networks documentation on Cloud NGFW

Panorama overview in Palo Alto Knowledge Base

VM-Series firewalls deployment guide in CSPs: Palo Alto Documentation

The problem provides several constraints and design requirements that must be carefully

considered:

Bandwidth Requirement:

The customer needs an NGFW capable of handling a total throughput of 72 Gbps.

The PA-5445 is specifically designed for high-throughput environments and supports up to 81.3 Gbps

Threat Prevention throughput (as per the latest hardware performance specifications). This ensures

the throughput needs are fully met with some room for growth.

Interface Compatibility:

The customer mentions that their core switches support up to 40 Gbps interfaces. The design must

include aggregate links to meet the overall bandwidth while aligning with the 40 Gbps interface

limitations.

The PA-5445 supports 40Gbps QSFP+ interfaces, making it a suitable option for the hardware

requirement.

No Change to IP Address Structure:

Since the customer cannot modify their IP address structure, deploying the NGFW in Layer-2 or

Virtual Wire mode is ideal.

Virtual Wire mode allows the firewall to inspect traffic transparently between two Layer-2 devices

without modifying the existing IP structure. Similarly, Layer-2 mode allows the firewall to behave like

a switch at Layer-2 while still applying security policies.

Threat Prevention, DNS, and Sandboxing Requirements:

The customer requires advanced security features like Threat Prevention and potentially sandboxing

(WildFire). The PA-5445 is equipped to handle these functionalities with its dedicated hardware-

based architecture for content inspection and processing.

Aggregate Interface Groups:

The architecture should include aggregate interface groups to distribute traffic across multiple

physical interfaces to support the high throughput requirement.

By aggregating 2 x 40Gbps interfaces on both sides of the path in Virtual Wire or Layer-2 mode, the

design ensures sufficient bandwidth (up to 80 Gbps per side).

Why PA-5445 in Layer-2 or Virtual Wire mode is the Best Option:

Option A satisfies all the customer’s requirements:

The PA-5445 meets the 72 Gbps throughput requirement.

2 x 40 Gbps interfaces can be aggregated to handle traffic flow between the core switches and the

NGFW.

Virtual Wire or Layer-2 mode preserves the IP address structure, while still allowing full threat

prevention and DNS inspection capabilities.

The PA-5445 also supports sandboxing (WildFire) for advanced file-based threat detection.

Why Not Other Options:

Option B:

The PA-5430 is insufficient for the throughput requirement (72 Gbps). Its maximum Threat

Prevention throughput is 60.3 Gbps, which does not provide the necessary capacity.

Option C:

While the PA-5445 is appropriate, deploying it in Layer-3 mode would require changes to the IP

address structure, which the customer explicitly stated is not an option.

Option D:

The PA-5430 does not meet the throughput requirement. Although Layer-2 or Virtual Wire mode

preserves the IP structure, the throughput capacity of the PA-5430 is a limiting factor.

Reference from Palo Alto Networks Documentation:

Palo Alto Networks PA-5400 Series Datasheet (latest version)

Specifies the performance capabilities of the PA-5445 and PA-5430 models.

Palo Alto Networks Virtual Wire Deployment Guide

Explains how Virtual Wire mode can be used to transparently inspect traffic without changing the

existing IP structure.

Aggregated Ethernet Interface Documentation

Details the configuration and use of aggregate interface groups for high throughput.

Advanced DNS Security on Palo Alto Networks firewalls is designed to identify and prevent a wide

range of DNS-based attacks. Among the listed options, "High entropy DNS domains" is a specific

example of a DNS attack that Advanced DNS Security can detect and block.

Why "High entropy DNS domains" (Correct Answer A)?

High entropy DNS domains are often used in attacks where randomly generated domain names (e.g.,

gfh34ksdu.com) are utilized by malware or bots to evade detection. This is a hallmark of Domain

Generation Algorithms (DGA)-based attacks. Palo Alto Networks firewalls with Advanced DNS

Security use machine learning to detect such domains by analyzing the entropy (randomness) of DNS

queries. High entropy values indicate the likelihood of a dynamically generated or malicious domain.

Why not "Polymorphic DNS" (Option B)?

While polymorphic DNS refers to techniques that dynamically change DNS records to avoid

detection, it is not specifically identified as an attack type mitigated by Advanced DNS Security in

Palo Alto Networks documentation. The firewall focuses more on the behavior of DNS queries, such

as detecting DGA domains or anomalous DNS traffic patterns.

Why not "CNAME cloaking" (Option C)?

CNAME cloaking involves using CNAME records to redirect DNS queries to malicious or hidden

domains. Although Palo Alto firewalls may detect and block malicious DNS redirections, the focus of

Advanced DNS Security is primarily on identifying patterns of DNS abuse like DGA domains,

tunneling, or high entropy queries.

Why not "DNS domain rebranding" (Option D)?

DNS domain rebranding involves changing the domain names associated with malicious activity to

evade detection. This is typically a tactic used for persistence but is not an example of a DNS attack

type specifically addressed by Advanced DNS Security.

Advanced DNS Security focuses on dynamic, real-time identification of suspicious DNS patterns, such

as high entropy domains, DNS tunneling, or protocol violations. High entropy DNS domains are

directly tied to attack mechanisms like DGAs, making this the correct answer.

Reference: According to Palo Alto Networks Advanced DNS Security documentation, detecting high

entropy domains is a core feature of the service, leveraging machine learning and behavioral analysis

to identify and block such malicious activities.