Which three user authentication services can be modified to provide the Palo Alto Networks NGFW with both usernames and role names? (Choose three.)

Question

Options

• ATACACS+
• BKerberos
• CPAP
• DLDAP
• ESAML
• FRADIUS

• A
  92% (36)
• C
  5% (2)
• E
  3% (1)

Explanation

TACACS+, LDAP, and RADIUS are the three correct answers because each supports returning both a username and role/group attributes that PAN-OS can map to admin role profiles. RADIUS accomplishes this through Vendor-Specific Attributes (VSAs), TACACS+ returns role data in its authorization response, and LDAP allows the NGFW to query group memberships alongside user identity.

Why the distractors are wrong:

• Kerberos (B): Handles authentication via tickets but has no native mechanism to return role or group attributes to the NGFW.
• PAP (C): A bare-bones credential transport protocol - it only carries a username and password with no support for role data whatsoever.
• SAML (E): While SAML can carry attributes and is supported for GlobalProtect/management auth, it is not one of the three modifiable server profile types used to deliver role names in the classic PAN-OS authentication/authorization flow tested here.

Memory tip: Think "RAT-L" - RADIUS, Admin-via-TACACS+, LDAP. These are the three full AAA or directory services; the wrong answers (Kerberos, PAP, SAML) are either pure authentication protocols or a federation standard that lacks the two-way attribute-return mechanism PAN-OS relies on for role assignment.

No community discussion yet for this question.