PCNSE · Question #842
A company has a PA-3220 NGFW at the edge of its network and wants to use active directory groups in its Security policy rules. There are 1500 groups in its active directory. An engineer has been…
The correct answer is C. Create a Group Include List with the 800 Active Directory groups. The Group Include List in the Group Mapping settings of a Palo Alto Networks firewall allows the administrator to specify the exact Active Directory groups that need to be imported and used in policies. Although the active directory may contain 1500 groups, the engineer only…
Question
A company has a PA-3220 NGFW at the edge of its network and wants to use active directory groups in its Security policy rules. There are 1500 groups in its active directory. An engineer has been provided 800 active directory groups to be used in the Security policy rules. What is the engineer's next step?
Options
- ACreate a Group Mapping with 800 groups in the Group Include List.
- BCreate two Group Include Lists, each with 400 Active Directory groups.
- CCreate a Group Include List with the 800 Active Directory groups.
- DCreate two Group Mappings, each with 400 groups in the Group Include List.
How the community answered
(40 responses)- A18% (7)
- B3% (1)
- C70% (28)
- D10% (4)
Explanation
The Group Include List in the Group Mapping settings of a Palo Alto Networks firewall allows the administrator to specify the exact Active Directory groups that need to be imported and used in policies. Although the active directory may contain 1500 groups, the engineer only needs 800 groups. By creating a single Group Include List with the required 800 groups, the firewall will retrieve and map only those groups, ensuring efficient operation without exceeding the limits or unnecessarily importing unused groups.
Topics
Community Discussion
No community discussion yet for this question.