Exam NGFW-Engineer Topic 2 Question 27 Discussion
Actual exam question for Palo Alto Networks's NGFW-Engineer exam
Question #: 27
Topic #: 2
Question #: 27
Topic #: 2
A multinational organization wants to use the Cloud Identity Engine (CIE) to aggregate identity data from multiple sources (on premises AD, Azure AD, Okta) while enforcing strict data isolation for different regional business units. Each region's firewalls, managed via Panorama, must only receive the user and group information relevant to that region. The organization aims to minimize administrative overhead while meeting data sovereignty requirements.
Which approach achieves this segmentation of identity data?
Which approach achieves this segmentation of identity data?
Suggested Answer: D Vote an answer
Basic Concept: Cloud Identity Engine can aggregate identity sources and segment identity data so only relevant users and groups are redistributed to the proper firewalls.
Why D is Correct: Segments within a single CIE tenant minimize overhead while filtering and redistributing only the identities each regional firewall group should receive.
Why A is Wrong: Create one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
Why B is Wrong: Establish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region's firewalls, maintaining a strict one-to-one mapping of tenant to business unit. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
Why C is Wrong: Disable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs). is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama- controlled policy design in this scenario.
Why D is Correct: Segments within a single CIE tenant minimize overhead while filtering and redistributing only the identities each regional firewall group should receive.
Why A is Wrong: Create one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
Why B is Wrong: Establish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region's firewalls, maintaining a strict one-to-one mapping of tenant to business unit. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
Why C is Wrong: Disable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs). is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama- controlled policy design in this scenario.
by Jim at Aug 13, 2026, 07:16 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).