PSE-Strata-Pro-24 Exam Dumps : Palo Alto Networks Systems Engineer Professional - Hardware Firewall

When high traffic from Palo Alto Networks NGFWs to Active Directory servers causes performance issues, optimizing the way NGFWs gather user-to-IP mappings is critical. Palo Alto Networks offers multiple ways to collect user identity information, andCloud Identity Engineprovides a solution that reduces the load on AD servers while still ensuring efficient and accurate mapping.

Option A (Correct):Cloud Identity Engineallows NGFWs to gather user-to-IP mappings directly from Active Directory authentication logs or other identity sources without placing heavy traffic on the AD servers. By leveraging this feature, the NGFW can offload authentication-related tasks and efficiently identify users without overloading AD servers. This solution is scalable and minimizes the overhead typically caused by frequent User-ID queries to AD servers.

Option B:UsingGlobalProtect Windows SSOto gather user information can add complexity and is not the most efficient solution for this problem. It requires all users to install GlobalProtect agents, which may not be feasible in all environments and can introduce operational challenges.

Option C:Data redistributioninvolves redistributing user-to-IP mappings from one NGFW (hub) to other NGFWs (spokes). While this can reduce the number of queries sent to AD servers, it assumes the mappings are already being collected from AD servers by the hub, which means the performance issue on the AD servers would persist.

Option D:UsingGlobalProtect agentsto gather user information is a valid method for environments where GlobalProtect is already deployed, but it is not the most efficient or straightforward solution for the given problem. It also introduces dependencies on agent deployment, configuration, and management.

How to Implement Cloud Identity Engine for User-ID Mapping:

EnableCloud Identity Enginefrom the Palo Alto Networks console.

Integrate the Cloud Identity Engine with the AD servers to allow it to retrieve authentication logs directly.

Configure the NGFWs to use the Cloud Identity Engine for User-ID mappings instead of querying the AD servers directly.

Monitor performance to ensure the AD servers are no longer overloaded, and mappings are being retrieved efficiently.

References:

Cloud Identity Engine Overview:

User-ID Best Practices:

Cobalt Strike is a popular post-exploitation framework often used by attackers for Command and Control (C2) operations. Malleable C2 profiles allow attackers to modify the behavior of their C2 communication, making detection more difficult. Stopping these attacks inreal timerequires deep inline inspection and the ability to block zero-day and evasive threats.

Why "Advanced Threat Prevention and PAN-OS 10.2" (Correct Answer B)?Advanced Threat Prevention (ATP) on PAN-OS 10.2 usesinline deep learning modelsto detect and blockCobalt Strike Malleable C2 attacksin real time. ATP is designed to prevent evasive techniques and zero-day threats, which is essential for blocking Malleable C2. PAN-OS 10.2 introduces enhanced capabilities for detecting malicious traffic patterns and inline analysis of encrypted traffic.

ATP examines traffic behavior and signature-less threats, effectively stopping evasive C2 profiles.

PAN-OS 10.2 includes real-time protections specifically for Malleable C2.

Why not "Next-Generation CASB on PAN-OS 10.1" (Option A)?Next-Generation CASB (Cloud Access Security Broker) is designed to secure SaaS applications and does not provide the inline C2 protection required to stop Malleable C2 attacks. CASB is not related to Command and Control detection.

Why not "Threat Prevention and Advanced WildFire with PAN-OS 10.0" (Option C)?Threat Prevention and Advanced WildFire are effective for detecting and preventing malware and known threats. However, they rely heavily on signatures and sandboxing for analysis, which is not sufficient for stoppingreal-time evasive C2 traffic. PAN-OS 10.0lacks the advanced inline capabilities provided by ATP in PAN-OS 10.2.

Why not "DNS Security, Threat Prevention, and Advanced WildFire with PAN-OS 9.x" (Option D)?While DNS Security and Threat Prevention are valuable for blocking malicious domains and known threats, PAN-OS 9.x does not provide the inline deep learning capabilities needed for real-time detection and prevention of Malleable C2 attacks. The absence of advanced behavioral analysis in PAN-OS 9.x makes this combination ineffective against advanced C2 attacks.

Palo Alto Networks' PAN-OS supports API keys for authentication when interacting with the firewall’s RESTful and XML-based APIs. By default, API keys do not have an expiration time set, but the expiration time for API keys can be configured by an administrator to meet specific requirements, such as a time-based deactivation after two hours. This is particularly useful for compliance and security purposes, where API keys should not remain active indefinitely.

Here’s an evaluation of the options:

Option A:This is incorrect because the default setting for API keys does not include an expiration time. By default, API keys are valid indefinitely unless explicitly configured otherwise.

Option B:This is incorrect because PAN-OS fully supports API keys. The API keys are integral to managing access to the firewall's APIs and provide a secure method for authentication.

Option C:This is incorrect because PAN-OS does support API key expiration when explicitly configured. While the default is "no expiration," the feature to configure an expiration time (e.g., 2 hours) is available.

Option D (Correct):The correct response to the RFP clause is that the default API key settings need to be modified to set the expiration time to 120 minutes (2 hours). This aligns with the customer requirement to enforce API key deactivation based on time. Administrators can configure this using the PAN-OS management interface or the CLI.

How to Configure API Key Expiration (Steps):

Access theWeb InterfaceorCLIon the firewall.

Navigate toDevice > Management > API Key Lifetime Settings(on the GUI).

Set the desired expiration time (e.g., 120 minutes).

Alternatively, use the CLI to configure the API key expiration:

set deviceconfig system api-key-expiry

commit

Verify the configuration using the show command or by testing API calls to ensure the key expires after the set duration.

References:

Palo Alto Networks API Documentation:

Configuration Guide: Managing API Key Expiration