PCNSA · Question #108
What are three methods of mapping usernames to IP addresses? (Choose three.)
The correct answer is A. Server Monitoring D. syslog F. port mapping. User-ID on Palo Alto Networks firewalls can map usernames to IP addresses using various methods, including direct server monitoring, parsing syslog messages, and client probing (port mapping).
Question
What are three methods of mapping usernames to IP addresses? (Choose three.)
Options
- AServer Monitoring
- BTraps
- CMinemeld
- Dsyslog
- EAutoFocus
- Fport mapping
How the community answered
(42 responses)- A95% (40)
- B2% (1)
- C2% (1)
Why each option
User-ID on Palo Alto Networks firewalls can map usernames to IP addresses using various methods, including direct server monitoring, parsing syslog messages, and client probing (port mapping).
Server Monitoring (e.g., Active Directory, eDirectory) allows the firewall to directly query domain controllers for user login events, creating dynamic IP-to-username mappings.
Traps (now Cortex XDR) is an endpoint protection platform, not a method for the firewall to map usernames to IP addresses for User-ID purposes.
Minemeld is a threat intelligence aggregation and correlation platform used for creating custom threat feeds, not for dynamically mapping usernames to IP addresses on the firewall.
Syslog Listener allows the firewall to parse syslog messages from various devices (e.g., authenticating proxies, wireless controllers) to extract user login information and create IP-to-username mappings.
AutoFocus is a cloud-based threat intelligence service, providing context on threats, but it does not directly map usernames to IP addresses for firewall User-ID.
Port mapping, often referred to as client probing, involves the firewall sending probes (e.g., NetBIOS, NTLM) to an IP address to determine the logged-in user, typically used when other methods fail or are not available.
Concept tested: Palo Alto Networks User-ID mapping methods
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/user-id-overview/user-id-mapping-methods
Topics
Community Discussion
No community discussion yet for this question.