A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency. Which approach best addresses these requirements while maintaining consistent policy enforcement?
Correct Answer: B
This approach best addresses the enterprise's requirements for certificate-based authentication, OCSP checks, and consistent policy enforcement: Distributing the root and intermediate CA certificates via Panorama ensures that all firewalls in the enterprise are consistent in their trust chain and can validate certificates properly. Configuring OCSP responder profiles on each firewall offloads the revocation checks to an internal OCSP server, which reduces the overhead on the firewalls and ensures fast, real-time certificate status checks. Using CRL checks as a fallback ensures reliability in case the OCSP responder is unavailable. Separate certificate profiles for users and devices ensure that the firewall can enforce different security policies based on the type of certificate (user vs. device). Automated certificate enrollment methods such as Group Policy or SCEP streamline certificate distribution to endpoints, ensuring efficient management of certificates across geographically dispersed firewalls.
Question 72
A network administrator needs to replace the default self-signed certificate on a firewall with one signed by the company's internal certificate authority (CA). Which two firewall features would require this new certificate to be assigned via an SSL/TLS service profile? (Choose two.)
Correct Answer: C,D
Basic Concept: SSL/TLS service profiles assign server certificates and TLS settings to firewall-hosted HTTPS services. Authentication Portal and GlobalProtect Gateway are services that present certificates to clients. Why C and D are Correct: Authentication Portal and GlobalProtect Gateway require SSL/TLS service profiles when replacing default/self-signed certificates with enterprise CA certificates. Why A is Wrong: User-ID agent redistribution is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested. Why B is Wrong: RADIUS server authentication is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.
Question 73
Which zone type allows traffic between zones in different virtual systems (VSYS), without the traffic leaving the firewall?
Correct Answer: C
External zones enable inter-VSYS communication internally on the firewall by associating with a specific VSYS and allowing traffic to traverse to visible external zones of other VSYS, requiring VSYS visibility configuration and security policies from internal zones to/from the external zone.
Question 74
When considering the various methods for User-ID to learn user-to-IP address mappings, which source is considered the most accurate due to the mapping being explicitly created through an authentication event directly with the firewall?
Correct Answer: D
Authentication Portal creates user-to-IP mappings through a direct authentication interaction between the user and the firewall, making the identity association explicit, immediate, and highly accurate compared to inferred or log-based mapping methods.
Question 75
An administrator must perform several actions on a fleet of firewalls from a central Panorama instance. To maintain efficiency, the administrator wants to only perform actions that do not require switching context into each firewall's individual web interface. Which set of actions is available to the administrator directly from the Panorama UI?
Correct Answer: B
Basic Concept: Panorama can manage shared objects, templates, and device-group policy directly. Local runtime inspection and some per-device operational views require context switching. Why B is Correct: Modifying a pre-rule, editing a shared service object, and creating a certificate profile are Panorama-level configuration tasks. Why A is Wrong: Creating a new VLAN - Assigning an interface to the new VLAN Configuring a new DHCP server on the firewall is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome. Why C is Wrong: Accessing the CLI - Restarting the device - Installing the latest content and software versions is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome. Why D is Wrong: Configuring a new IPSec tunnel - Modifying the IKE gateway - Changing the DNS server settings of the firewall is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
