Palo Alto Networks NGFW-Engineer Exam - Topic 1 Question 28 Discussion

Question

A holding company has recently acquired two new businesses, each with its own Okta identity provider. The holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three organizations' firewalls. However, for legal reasons, the firewalls of Company A must only receive identity data from Company A's Okta instance, and the firewalls of Company B must only receive data from Company B's Okta instance.

Which configuration in CIE supports this requirement with highest operational efficiency?

Brandon · Accepted Answer

A) Configure a CIE tenant, connect Okta, and create segments.

Brandon · Answer

B) Configure the firewalls for each company to query their respective Okta IdPs directly, bypassing CIE for redistribution.

Brandon · Answer

C) Push all identity data to Panorama and use Panorama's group mapping include/exclude lists to control what each firewall learns.

Brandon · Answer

D) Create a master CIE tenant for the holding company and peer it with two subordinate tenants, one for each acquired business.