PCNSE Troubleshoot Practice Question
A firewall is configured with User-ID mapping via domain controller polling. Some users are not being mapped correctly. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume User-ID requires a separate agent (Option B) or that network connectivity alone is sufficient (Option C), overlooking the specific RPC protocol dependency that is commonly blocked by domain controller security policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The domain controller security policy is blocking RPC traffic.
User-ID mapping via domain controller polling relies on the firewall querying the domain controller's security event logs using RPC (Remote Procedure Call). If the domain controller's security policy blocks RPC traffic (typically TCP port 135 and dynamic RPC ports), the firewall cannot retrieve the login events needed to map users to IP addresses, causing incorrect or missing User-ID mappings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall is not configured for TLS decryption.
Why it's wrong here
TLS decryption is unrelated to User-ID mapping.
- ✗
The user-ID agent is not installed.
Why it's wrong here
For DC polling, the user-ID agent is not required; the firewall polls directly.
- ✗
The firewall does not have network access to the domain controller.
Why it's wrong here
Network access is necessary but a more specific cause is RPC being blocked.
- ✓
The domain controller security policy is blocking RPC traffic.
Why this is correct
RPC is used for User-ID polling; if blocked, mapping fails.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.