Exam PCNSA topic 1 question 82 discussion

Correct options should be B and C: To dynamically register tags, you can use: - the XML API - the User-ID agent - Panorama - the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

B and D are the answers. See the text from PCNSE Study Guide: Several methods are available to tag or untag usernames. As shown in the following screenshot (in the book), you can manually tag and untag usernames by using the web interface. Usernames can also be tagged and untagged by using the auto-tagging feature in a Log Forwarding Profile. (NOTE: I have practically done both.). You also can program another utility to invoke the PAN-OS XML API commands to tag or untag usernames. (NOTE: I've not tried XML API myself tho.

B&D for me: Auto-tagging allows the firewall or Panorama to tag a policy object when it receives a log that matches specific criteria and establish IP address-to-tag or user-to-tag mapping. For example, when the firewall generates a threat log, you can configure the firewall to tag the source IP address or source user in the threat log with a specific tag name. You can then use these tags to automatically populate policy objects such as dynamic user groups or dynamic address groups. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions

I just checked question 96 and the answer for this must be B and C https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

B. XML API The XML API can be used to programmatically tag usernames. This allows administrators to dynamically assign tags to users based on various criteria or external inputs. These tags can then be used to include the users in dynamic user groups. D. Log forwarding auto-tagging Log forwarding auto-tagging allows for automated tagging based on log entries. When specific logs match predefined criteria, the system can automatically tag the associated usernames. These tags are then used to include the users in dynamic user groups.

This question should be reviewed further, according the documentation here is the statement: "You can then use these tags to automatically populate policy objects such as dynamic user groups or dynamic address groups, which can then be used to automate security actions in security, authentication, or decryption policies" Depending on the type of log you want to use for tagging, create a log forwarding profile or configure the log settings to define how you want the firewall or Panorama to handle logs. For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile. For User-ID, GlobalProtect, and IP-Tag logs, configure the log settings https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions

To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall

To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

Just one question Are User-ID Agent and User-ID Windows based Agent the same thing? If different, the answer should be A and D

answer BD

According to PCNSA Study Guide

answer: BD https://docs.paloaltonetworks.com/best-practices/10-1/user-id-best-practices/user-id-best-practices/user-id-best-practices-for-dynamic-user-groups Firewall logs - create a log forwarding profile and use the Built-In Actions Custom API scripts

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

Its B and D, "You can manually tag and untag usernames using the web interface. Usernames can also be tagged and untagged by using the auto-tagging feature in a log forwarding profile or by programming another utility to invoke PAN-OS XML API commands. " Got this from a file called EDU-210-10.1a-M12-UserID-1.pdf which is can be access in the EDU-210 training course.

They are askting to tag a specific user. From the given options it mus be B and C. I agree that you would need D to scan your logs and automatically tag users if something happens but the answer does not match the question. A is out of question

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups

I think it BD