PCNSE Core Concepts and Architecture Practice Question
Which two are valid methods for collecting User-ID information on a Palo Alto Networks firewall? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse Syslog parsing or SNMP traps as valid User-ID sources because they are common in other security contexts, but Palo Alto Networks specifically requires authentication-based methods like AD agent, Captive Portal, or XFF headers for User-ID collection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active Directory agent
The Active Directory agent is a dedicated software component that integrates with Microsoft Active Directory to map user logon events to IP addresses, providing real-time User-ID information to the firewall. Option E is correct because Captive Portal actively authenticates users via browser-based or agent-based authentication, associating their IP address with a username upon successful login, which is a direct method for collecting User-ID data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Syslog parsing
Why it's wrong here
Syslog parsing is not a native User-ID method; it requires a special integration.
- ✗
Email gateway
Why it's wrong here
Email gateway is not a User-ID collection method.
- ✓
Active Directory agent
Why this is correct
The AD agent polls domain controllers for user logon events.
- ✗
SNMP trap
Why it's wrong here
SNMP traps lack the bidirectional mapping between IP addresses and authenticated usernames required for User-ID; they only relay read-only network events like link status changes. This option tempts because SNMP is commonly used for monitoring device health, and in scenarios where a firewall receives SNMP traps from a RADIUS server or Microsoft Entra ID, it could theoretically correlate IP-to-user mappings—but Palo Alto Networks firewalls do not natively parse SNMP traps for user identification, relying instead on protocols like LDAP or captive portal.
- ✓
Captive portal
Why this is correct
Captive portal authenticates users and maps them to IP addresses.
Go deeper
Related to this question
About these practice questions
One of 504 original PCNSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.