What are two ways to manually add and remove members of dynamic user groups (DUGs)? (Choose two)

Question

Options

• AAdd the user to an external dynamic list (EDL).
• BTag the user using Panorama or the Web Ul of the firewall.
• CTag the user through the firewalls XML API.
• DTag the user through Active Directory

• A
  20% (5)
• B
  72% (18)
• D
  8% (2)

Explanation

Dynamic User Groups (DUGs) are driven by tags, so to manually add or remove a user you must apply or remove a tag - which can be done through Panorama/the firewall Web UI (B) or the firewall's XML API (C); both methods let you register user-IP tag mappings directly.

Why the distractors are wrong:

• A - External Dynamic Lists (EDLs) contain IPs, domains, or URLs, not user identity tags; they have no mechanism to add individual users to a DUG.
• D - Active Directory can feed user and group data into User-ID, but it is not a tagging mechanism; you cannot use AD itself to apply PAN-OS tags that populate a DUG.

Memory tip: Think "DUG = Tags, Tags = UI or API." If the method doesn't let you register a tag on a user, it won't work for DUGs. Panorama/Web UI and the XML API are the two tagging interfaces, making B and C the only valid manual methods.

No community discussion yet for this question.