PCNSE Question #440: Real Exam Question with Answer & Explanation

Question

To support a new compliance requirement, your company requires positive username attribution of every IP address used by wireless devices. You must collect IP address-to-username mappings as soon as possible with minimal downtime and minimal configuration changes to the wireless devices themselves. The wireless devices are from various manufacturers. Given the scenario, choose the option for sending IP address-to-username mappings to the firewall

Options

• AUID redistribution
• BRADIUS
• Csyslog listener
• DXFF headers

Explanation

To collect IP address-to-username mappings from diverse wireless devices with minimal changes and downtime, configuring the firewall as a syslog listener is the most suitable method.

Common mistakes.

• A. UID redistribution is a mechanism to share User-ID mappings between firewalls, not to initially collect them from client devices or wireless infrastructure.
• B. While RADIUS is involved in authentication, relying on the firewall as a direct RADIUS client or proxy for all wireless devices might involve more configuration and potential downtime than simply consuming existing syslog feeds from the wireless controller or RADIUS server.
• D. XFF headers carry the original client IP address in proxy scenarios and do not provide username attribution directly from wireless devices.

Concept tested. User-ID mapping sources for wireless environments

Reference. https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders.html

No community discussion yet for this question.