Why User-ID Mapping Does Not Appear for Active Users
Which TWO factors can cause a firewall to not show any User-ID mapping for a user who is actively logged in?
Quick Answer
The correct answer centers on the domain controller failing to forward the security events that create User-ID mappings in the first place, because User-ID mapping is fundamentally a pipeline: an event has to be generated on the domain controller, that event has to be collected and forwarded to the User-ID agent, and the agent then has to relay the resulting mapping to the firewall. A break at any point in that chain means no mapping appears, even though the user is genuinely logged in and their actual network activity hasn't changed at all. If the domain controller simply isn't sending the relevant security events, the agent never has raw material to build a mapping from, regardless of how well the agent itself or the firewall's User-ID configuration is set up. A separate but equally valid failure point is the agent not knowing the firewall is a client it should forward mappings to, which produces the identical symptom of an actively logged-in user with no visible mapping, even though the agent is successfully collecting data from the domain controller. When troubleshooting missing User-ID mappings, walk the pipeline end to end, from event generation, to collection, to agent-to-firewall forwarding, since an otherwise correct configuration anywhere along that chain won't help if an earlier link is broken.
⚠ Common exam trap
Test-takers frequently confuse 'collector mode' with a failure to send mappings, but collector mode actually aggregates and forwards data, so it does not cause missing mappings; the real issue is the missing client IP configuration on the agent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The User-ID agent is not configured with the firewall's IP as a client
The User-ID agent must be configured with the firewall's IP address as a client to forward user-to-IP mappings. Without this configuration, the firewall will not receive the mapping data from the agent, even if the user is actively logged in and the agent is collecting security events from the domain controller.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is using a VPN connection from a remote location
Why it's wrong here
VPN users can still have mappings if the agent receives authentication events.
- ✗
The firewall's User-ID agent is in collector mode
Why it's wrong here
Collector mode aggregates mappings from other agents, it does not prevent mapping.
- ✓
The User-ID agent is not configured with the firewall's IP as a client
Why this is correct
The agent must have the firewall listed as a client to send mappings.
- ✗
The user's traffic is being decrypted by SSL decryption
Why it's wrong here
SSL decryption does not interfere with User-ID mapping.
- ✓
The domain controller is not forwarding security events to the User-ID agent
Why this is correct
Without security events, the agent cannot create mappings.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses User-ID to map users to IPs. Some users report that their traffic is being blocked even though they are in the correct user group for access. The security policy uses user-based conditions. What is a likely cause?
medium- A.The security policy order is incorrect
- B.The firewall is not configured to use the User-ID agent
- C.The User-ID agent is not running
- ✓ D.The user's IP is not in the User-ID mapping table
Why D: When a security policy uses user-based conditions, the firewall must have a valid User-ID mapping for the user's IP address to enforce the rule. If the user's IP is not in the User-ID mapping table, the firewall cannot associate the traffic with a user group, and it will either match a default deny rule or fail to match the intended allow rule, resulting in blocked traffic. This is the most direct cause given that the user group assignment is correct but the mapping is missing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.