nerdexam
Palo_Alto_Networks

PCNSA · Question #108

What are three methods of mapping usernames to IP addresses? (Choose three.)

The correct answer is A. Server Monitoring D. syslog F. port mapping. User-ID on Palo Alto Networks firewalls can map usernames to IP addresses using various methods, including direct server monitoring, parsing syslog messages, and client probing (port mapping).

Submitted by daniela_cl· Apr 18, 2026Configure

Question

What are three methods of mapping usernames to IP addresses? (Choose three.)

Options

  • AServer Monitoring
  • BTraps
  • CMinemeld
  • Dsyslog
  • EAutoFocus
  • Fport mapping

How the community answered

(42 responses)
  • A
    95% (40)
  • B
    2% (1)
  • C
    2% (1)

Why each option

User-ID on Palo Alto Networks firewalls can map usernames to IP addresses using various methods, including direct server monitoring, parsing syslog messages, and client probing (port mapping).

AServer MonitoringCorrect

Server Monitoring (e.g., Active Directory, eDirectory) allows the firewall to directly query domain controllers for user login events, creating dynamic IP-to-username mappings.

BTraps

Traps (now Cortex XDR) is an endpoint protection platform, not a method for the firewall to map usernames to IP addresses for User-ID purposes.

CMinemeld

Minemeld is a threat intelligence aggregation and correlation platform used for creating custom threat feeds, not for dynamically mapping usernames to IP addresses on the firewall.

DsyslogCorrect

Syslog Listener allows the firewall to parse syslog messages from various devices (e.g., authenticating proxies, wireless controllers) to extract user login information and create IP-to-username mappings.

EAutoFocus

AutoFocus is a cloud-based threat intelligence service, providing context on threats, but it does not directly map usernames to IP addresses for firewall User-ID.

Fport mappingCorrect

Port mapping, often referred to as client probing, involves the firewall sending probes (e.g., NetBIOS, NTLM) to an IP address to determine the logged-in user, typically used when other methods fail or are not available.

Concept tested: Palo Alto Networks User-ID mapping methods

Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/user-id-overview/user-id-mapping-methods

Topics

#User-ID#IP-to-User Mapping#Authentication Methods

Community Discussion

No community discussion yet for this question.

Full PCNSA Practice