PCNSE · Question #591
An engineer needs to collect User-ID mappings from the company's existing proxies. What two methods can be used to pull this data from third party proxies? (Choose two.)
The correct answer is A. Syslog B. XFF Headers. This question identifies the two methods a Palo Alto Networks firewall can use to collect User-ID mappings from third-party proxy servers.
Question
An engineer needs to collect User-ID mappings from the company's existing proxies. What two methods can be used to pull this data from third party proxies? (Choose two.)
Options
- ASyslog
- BXFF Headers
- CClient probing
- DServer Monitoring
How the community answered
(58 responses)- A91% (53)
- C5% (3)
- D3% (2)
Why each option
This question identifies the two methods a Palo Alto Networks firewall can use to collect User-ID mappings from third-party proxy servers.
Third-party proxies can be configured to send Syslog messages containing user-to-IP address mappings to the Palo Alto Networks firewall, allowing the firewall to build its User-ID table.
When traffic passes through a proxy, the proxy can insert an X-Forwarded-For (XFF) header into the HTTP request, which contains the original client's IP address, enabling the firewall to map this IP to a user if authenticated by the proxy.
Client probing is a User-ID method where the firewall actively queries client devices or authentication services directly, not a mechanism for retrieving data from proxy servers.
Server Monitoring in the context of User-ID typically refers to monitoring authentication servers like Active Directory or eDirectory for login events, not for pulling user mappings from proxy servers.
Concept tested: User-ID mapping from proxies
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-for-third-party-proxy-servers.html
Topics
Community Discussion
No community discussion yet for this question.