View all questions & answers for the Palo Alto Next-Generation Firewall Engineer Exam Materials exam
Palo Alto Next-Generation Firewall Engineer Exam Materials-Question 152 Discussion
Comments
Selected Answers: D
Selected Answers: A
Segments are exactly the multi-tenancy construct CIE provides: within one tenant you attach multiple identity sources (here, all three Okta instances via SCIM/SAML connections) and then bind each source to its own segment. A firewall or Panorama-managed device group onboards against a specific segment, so it only ever sees the users and groups from that segment's Okta — full logical isolation with one tenant, one set of credentials, one place to manage it.
Why the others lose:
- B — abandons the stated requirement (single CIE instance for all three) and multiplies operational effort: per-firewall IdP config, per-firewall credential rotation, no shared group mapping. Lowest efficiency, not highest.
- C — Panorama group mapping include/exclude lists are a filtering mechanism, not an isolation boundary. All identity data still lands in a common pool, and maintaining exclusion lists across three orgs is manual, error-prone, and doesn't prevent cross-org leakage if a list is wrong.
- D — CIE has no master/subordinate tenant peering model. This is a distractor built on Panorama/HA vocabulary; there's no tenant hierarchy to configure.
Selected Answers: A
This is exactly the scenario Segments are designed for: a single CIE tenant connects to all three Okta directories (Directory Sync), and you use Segments to control which firewalls receive which subset of identity data — each company's firewalls subscribe only to the segment publishing their own Okta instance's data, keeping the three organizations' identity data isolated while still consolidating management into one CIE instance.
Why the others fail:
(b) Bypassing CIE defeats the stated goal of using "a single CIE instance" and abandons the operational efficiency CIE provides — you'd be back to managing three separate identity integrations per firewall.
(c) Panorama's include/exclude lists filter which groups are used for policy, but they don't control which directory source (Okta tenant) feeds data to which firewalls — that's a CIE Segments function, not a Panorama group-mapping function.
(d) There's no such thing as a "master CIE tenant peered with subordinate tenants" — this isn't a real CIE construct. Multiple directories are managed within tenants, and Segments (not tenant-peering) are what control data isolation/distribution.
Selected Answers: A
A holding company has recently acquired two new businesses, each with its own Okta identity provider. The holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three organizations' firewalls, while ensuring that each company's firewalls only receive identity data from their respective Okta instance. Which configuration in CIE supports this requirement with highest operational efficiency? (Choose one answer)
Brave-Dump Clients Votes