View all questions & answers for the Palo Alto Next-Generation Firewall Engineer Exam Materials exam

Palo Alto Next-Generation Firewall Engineer Exam Materials-Question 122 Discussion

A university uses Cloud Identity Engine (CIE) to integrate identity information from a Google Workspace directory for students and an on-premises Active Directory (AD) for faculty. The firewalls securing the faculty network should not process or store any student identity data. What is the most efficient method to ensure the faculty firewalls receive only faculty user and group information from CIE? (Choose one answer)

A. Allow all data to be redistributed and configure an “exclude” list within the Group Mapping settings on the faculty firewalls to ignore student groups.
B. Establish a dedicated CIE tenant solely for the faculty AD and connect the faculty firewalls to this new tenant.
C. Deploy a dedicated on-premises User-ID agent to read the AD and send its data directly to the faculty firewalls, keeping it separate from CIE.
D. Create a segment in CIE to filter attributes and redistribute user context to faculty firewalls.

Correct Answer: D

Brave-Dump Clients Votes

B 50%

D 50%

Comments

Anonymous User 2026-07-17 13:14:31

Selected Answers: B

B - Establish a dedicated CIE tenant for the faculty Active Directory and associate the faculty firewalls with that tenant.
The requirement says faculty firewalls must not process or store any student directory data. Palo Alto Networks describes a CIE tenant as a secure container used to isolate directory information between departments or business units.

Anonymous User 2026-08-20 14:30:43

Selected Answers: D

D. Create a segment in CIE to filter attributes and redistribute user context to faculty firewalls.
- B — A second tenant technically isolates the data but is the least efficient option. It duplicates licensing, onboarding, certificate trust, and administrative overhead, and fragments identity management across two consoles — exactly what segments exist to avoid.
Why D: Segments are the Cloud Identity Engine's native mechanism for partitioning directory data. You define a segment scoped to the on-prem AD (faculty) source, and firewalls associated with that segment receive only that segment's user and group context. The student Google Workspace data is never redistributed to the faculty firewalls at all — it's filtered at the source in CIE, not at the consumer. That satisfies both requirements: the faculty firewalls neither process nor store student identity data, and it's a single configuration change rather than new infrastructure.