Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)

The correct answer is A. log forwarding auto-tagging B. XML API. Dynamic user groups in PAN-OS are populated by applying tags to user identities, and policies are then built around those tags. (A) Log forwarding auto-tagging allows the firewall to automatically apply a tag to a username when a specific log event matches criteria defined in a l

Submitted by emma.c· Apr 18, 2026Deploy and Configure

Question

Exhibit

Options

Alog forwarding auto-tagging
BXML API
CGlobalProtect agent
DUser-ID Windows-based agent

How the community answered

(39 responses)

A
95% (37)
C
3% (1)
D
3% (1)

Explanation

Dynamic user groups in PAN-OS are populated by applying tags to user identities, and policies are then built around those tags. (A) Log forwarding auto-tagging allows the firewall to automatically apply a tag to a username when a specific log event matches criteria defined in a log forwarding profile - enabling automated, event-driven group membership. (B) The XML API allows external systems or scripts to programmatically register user-to-tag mappings on the firewall. The GlobalProtect agent (C) identifies and maps users to IPs but does not directly apply tags to users for dynamic groups. The Windows-based User-ID agent (D) maps usernames to IP addresses but also does not directly tag users for dynamic user group membership.

Topics

#User-ID#Dynamic User Groups#Auto-tagging#XML API

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice