Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)
Which two features can be used to tag a username so that it is included in a dynamic user group? (Choose two.)
Two features that can be used to tag a username so that it is included in a dynamic user group are log forwarding auto-tagging and XML API. Log forwarding auto-tagging allows the system to automatically add or remove members of dynamic user groups based on events in the logs. The XML API provides a programmable interface to tag or untag usernames. These methods facilitate dynamic inclusion of usernames in user groups based on predefined criteria or conditions.
From the PCNSE study guide, Dynamic User Groups (page 106): Usernames also can be tagged and untagged using the autotagging feature in a Log Forwarding Profile. You also can program another utility to invoke PAN-OS XML API commands to tag or untag usernames. In the web interface you can use logical AND or OR operators with the tags to better filter or match against. You can configure a timeout value that determines when a username will be untagged automatically. Based on that paragraph, A&B are the correct answers.
BD https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups.html To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall
The UserID agent referenced is Panorama and Data Redistribution, not the Windows agent.
On that same link though: The firewall redistributes the tags for the dynamic user group to the next hop and you can configure log forwarding to send the logs to a specific server. Log forwarding also allows you to use auto-tagging to automatically add or remove members of dynamic user groups based on events in the logs.
I think confusion comes from mixing two different "tools" 1. auto-tagging users to include them in DUG and 2. dynamically register tags. Those are two different operations. -to auto-tag users to DUG: auto-tagging in log-forwarding, XML API -to dynamically add tags: XML API, Panorama, User-ID -to statically add tags: WebUI
See comment of MS_NW BD https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups.html To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups
Its B and D https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-dynamic-user-groups-in-policy
B/D To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups
B and D ........To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall
On PAN-OS 10.1 the options are: To dynamically register tags, you can use: the XML API the User-ID agent Panorama the web interface on the firewall https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-dynamic-user-groups-in-policy
b and d sorry
On one side the study guide and the doc referred below confirm about the XML API & the Log Forwarding Profile Auto-Tagging. On the other side, the User-ID agent mentioned on the below document, refer to the Panorama User-ID agent and Remote-Firewall User-ID agent, in other words the redistribution agents "Step 6 -2" https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-dynamic-user-groups-in-policy
Agreed - Documentation talks about Panorama UserID agent being used for tagging. But not Windows UserID Agent.
A and B From PCNSE-Study-Guide Usernames can also be tagged and untagged using the auto-tagging feature in a Log Forwarding Profile. You also can program another utility to invoke PAN-OS XML API commands to tag or untag usernames.
B and D are correct. To dynamically register tags, you can use: - the XML API - the User-ID agent - Panorama - the web interface on the firewall Please refer to https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-dynamic-user-groups-in-policy
there are new questions about PAN OS 11, do you have them?
a d are correct
BD are correct
B-D the XML API the User-ID agent
A&B are the correct answers