The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named NewAdmin. This new administrator has…

To configure a local administrator account for passwordless authentication using a client certificate, the firewall must be configured to map the certificate to a locally defined user. This is achieved by creating an administrator account with the "Authentication" type set to "Certificate Based". The administrator's permissions are defined locally using a "Role Based" configuration, which links the account to a specific Admin Role profile. The firewall identifies the user by matching the Common Name (CN) field in the client's certificate to the administrator's username (NewAdmin).

B: A "Dynamic" role is incorrect. This role type is used when permissions are defined and returned by an external authentication server (like RADIUS or TACACS+), not for a local administrator with locally defined privileges.

C: An "Authentication Profile" is used for username/password authentication methods (e.g., RADIUS, LDAP, Local Database). Certificate-only authentication requires a "Certificate Profile" to validate the client certificate, not an Authentication Profile.

D: This option is incorrect for the same reason as option B. A "Dynamic" role is for externally defined permissions, which contradicts the requirement to create a local administrator profile with customized privileges defined on the firewall.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Configure Certificate-Based Administrator Authentication". The guide states

"To authenticate an administrator using a client certificate... you create an administrator account that references a certificate profile." The procedure involves creating a Role-Based administrator.

Reference Section: Device > Administrators > Add an Administrator Account. The "Administrator Type" must be set to "Role Based" to assign a locally defined Admin Role. The "Authentication" must be set to "Certificate Based".

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Device > Administrators". This section details the administrator account settings. It clarifies the "Administrator Type" options:

Role Based: "Select for an administrator with a predefined Admin Role profile."

Dynamic: "Select for a superuser role or for a role defined by a vendor-specific attribute (VSA) on a RADIUS or TACACS+ server."

This confirms that for a local profile with customized privileges

"Role Based" is the correct setting.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Device > Certificate Management > Certificate Profile". This section explains that for certificate-based authentication

a Certificate Profile is required. It specifies how to extract the username from the certificate

with "Common Name" being a standard option for the "Username Field".