When considering the various methods for User-ID to learn user-to-IP address mappings, which source is considered the most accurate due to the mapping being explicitly created through an…

The correct answer is D. Authentication Portal. The Authentication Portal (D) is considered the most accurate User-ID mapping source because the user actively and explicitly authenticates directly with the firewall itself - the firewall directly verifies the user's credentials and creates the IP-to-user mapping in real time…

User-ID Configuration and Management

Question

When considering the various methods for User-ID to learn user-to-IP address mappings, which source is considered the most accurate due to the mapping being explicitly created through an authentication event directly with the firewall?

Options

AX-Forwarded-For (XFF) headers
BServer monitoring
CGlobalProtect
DAuthentication Portal

How the community answered

(27 responses)

A
4% (1)
B
4% (1)
D
93% (25)

Explanation

The Authentication Portal (D) is considered the most accurate User-ID mapping source because the user actively and explicitly authenticates directly with the firewall itself - the firewall directly verifies the user's credentials and creates the IP-to-user mapping in real time as a result of that authenticated session. There is no intermediary or inference involved. X-Forwarded-For headers (A) rely on data inserted by proxies and can be spoofed or manipulated. Server monitoring (B) relies on reading event logs from domain controllers, which can introduce latency and depends on third-party log accuracy. GlobalProtect (C) maps users when they connect to the VPN, which is indirect and depends on the VPN client session rather than a direct authentication event with the firewall's User-ID subsystem.

Topics

#User-ID#Authentication#Identity Mapping#Palo Alto Networks

Community Discussion

No community discussion yet for this question.

Full NGFW-ENGINEER Practice