View all questions & answers for the Palo Alto Next-Generation Firewall Engineer Exam Materials exam


Palo Alto Next-Generation Firewall Engineer Exam Materials-Question 153 Discussion
Comment Image Comment Image Comment Image

A holding company has recently acquired two new businesses, each with its own Okta identity provider. The holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three organizations' firewalls, while ensuring that each company's firewalls only receive identity data from their respective Okta instance. Which configuration in CIE supports this requirement with highest operational efficiency? (Choose one answer)

  • A. Configure a CIE tenant, connect Okta, and create segments.
  • B. Configure the firewalls for each company to query their respective Okta IdPs directly, bypassing CIE for redistribution.
  • C. Push all identity data to Panorama and use Panorama's group mapping include/exclude lists.
  • D. Create a master CIE tenant and peer it with two subordinate tenants.
Correct Answer: D

Brave-Dump Clients Votes

D 50%
A 50%

Comments



Anonymous User 2026-02-25 03:49:19

Selected Answers: D


The most architecturally robust and operationally sound way to guarantee that is tenant isolation, not segmentation inside one tenant.

Anonymous User 2026-08-28 10:39:09

Selected Answers: A


A. Configure a CIE tenant, connect Okta, and create segments.

Segments are exactly the multi-tenancy construct CIE provides: within one tenant you attach multiple identity sources (here, all three Okta instances via SCIM/SAML connections) and then bind each source to its own segment. A firewall or Panorama-managed device group onboards against a specific segment, so it only ever sees the users and groups from that segment's Okta — full logical isolation with one tenant, one set of credentials, one place to manage it.

Why the others lose:
- B — abandons the stated requirement (single CIE instance for all three) and multiplies operational effort: per-firewall IdP config, per-firewall credential rotation, no shared group mapping. Lowest efficiency, not highest.
- C — Panorama group mapping include/exclude lists are a filtering mechanism, not an isolation boundary. All identity data still lands in a common pool, and maintaining exclusion lists across three orgs is manual, error-prone, and doesn't prevent cross-org leakage if a list is wrong.
- D — CIE has no master/subordinate tenant peering model. This is a distractor built on Panorama/HA vocabulary; there's no tenant hierarchy to configure.