Which two actions are required to make Microsoft Active Directory users appear in a firewall traffic log? (Choose two.)

The Palo Alto Networks User-ID Agent needs to read security event logs from Active Directory domain controllers to map user IP addresses to usernames. The account used by the agent must have "event log viewer" permissions on the domain controllers to access these logs.

RADIUS is primarily used for authentication and authorization, not for passive user-to-IP mapping for traffic logging purposes as User-ID does.

User-ID functionality, which maps IP addresses to usernames, must be explicitly enabled on the firewall security zone objects for the traffic that needs to be identified. Enabling it on the source zone ensures that incoming traffic from that zone has its users identified.

While User-ID is enabled on zones, it's typically enabled on the *source* zone where the users originate, not the destination zone, for user identification in traffic logs.

Running the User-ID Agent with "domain administrator" privileges is an excessive and unnecessary permission level for merely reading event logs; "event log viewer" is sufficient and adheres to the principle of least privilege.