If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

The correct answer is A. Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port. If you have Universal Groups, create an LDAP server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL, then create another LDAP server profile to connect to the root domain controllers on port 389. This helps ensure that users and…

Submitted by yaw92· Apr 18, 2026Configure

Question

Options

ACreate an LDAP Server profile to connect to the root domain of the Global Catalog server on port
BConfigure a frequency schedule to clear group mapping cache
CConfigure a Primary Employee ID number for user-based Security policies
DCreate a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or

How the community answered

(38 responses)

A
89% (34)
B
5% (2)
C
3% (1)
D
3% (1)

Explanation

If you have Universal Groups, create an LDAP server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL, then create another LDAP server profile to connect to the root domain controllers on port 389. This helps ensure that users and group information is available for all domains and subdomains. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-users-to-groups

Topics

#User-ID#Active Directory#Group Mapping#LDAP

Community Discussion

No community discussion yet for this question.

Full PCNSA Practice