NetSec-Architect Zero Trust Architecture And Design Practice Question
An architect is designing a high-scale User-ID implementation where domain controllers are located across multiple untrusted WAN domains without direct RPC access from the PAN-OS firewalls. Which method should the architect choose to securely and efficiently collect user-to-IP mappings while adhering to hardening best practices?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy dedicated User-ID Agents (or Panorama integrated agents) that securely communicate with firewalls using SSL/TLS, gathering logs via Syslog forwarding or server monitoring
When direct WMI polling or RPC to Domain Controllers is restricted or unscalable across network boundaries, deploying User-ID Agents or utilizing Panorama/Syslog parsing provides a robust, scalable solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rely exclusively on browser-based captive portal prompts for every single TCP session initiated by any user
Why it's wrong here
Incorrect. Captive portal for every session causes severe user friction and is not a scalable enterprise design.
- ✓
Deploy dedicated User-ID Agents (or Panorama integrated agents) that securely communicate with firewalls using SSL/TLS, gathering logs via Syslog forwarding or server monitoring
Why this is correct
Correct. User-ID Agents or Syslog listening securely ingest login events without requiring insecure direct RPC access from firewalls across trust boundaries.
- ✗
Configure the firewalls to perform continuous brute-force SNMP polling against all domain controller management interfaces
Why it's wrong here
Incorrect. SNMP does not provide user-to-IP mappings and brute-forcing violates security best practices.
- ✗
Disable authentication checks and allow unauthenticated guest access for all internal users
Why it's wrong here
Incorrect. This completely undermines identity-based Zero Trust policy enforcement.
About these practice questions
One of 228 original NetSec-Architect practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This NetSec-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NetSec-Architect exam.