A company with a large Active Directory (AD) of over 20,000 groups has user roles based on group membership in the directory. Up to 1,000 groups may…

Synchronizing a large Active Directory (AD) with over 20,000 groups can introduce significant

overhead if all groups are synchronized, especially when only a subset of groups (e.g., 1,000 groups)

are required for Security policies. The most efficient approach is to configure a group mapping profile

with an include group list to minimize unnecessary synchronization and reduce administrative

overhead.

Why "Configure a group mapping profile with an include group list" (Correct Answer C)?

Using a group mapping profile with an include group list ensures that only the required 1,000 groups

are synchronized with the firewall. This approach:

Reduces the load on the firewall's User-ID process by limiting the number of synchronized groups.

Simplifies management by focusing on the specific groups relevant to Security policies.

Avoids synchronizing the entire directory (20,000 groups), which would be inefficient and resource-

intensive.

Why not "Configure a group mapping profile, without a filter, to synchronize all groups" (Option B)?

Synchronizing all 20,000 groups would unnecessarily increase administrative and resource overhead.

This approach contradicts the requirement to reduce administrative burden.

Why not "Configure a group mapping profile with custom filters for LDAP attributes that are mapped

to the user roles" (Option A)?

While filtering LDAP attributes can be useful, this approach is more complex to implement and

manage compared to an include group list. It does not directly address the problem of limiting

synchronization to a specific subset of groups.

Why not "Configure NGFWs to synchronize with the AD after deploying the Cloud Identity Engine

(CIE) and agents" (Option D)?

While the Cloud Identity Engine (CIE) is a modern solution for user and group mapping, it is

unnecessary in this scenario. A traditional group mapping profile with an include list is sufficient and

simpler to implement. CIE is typically used for complex hybrid or cloud environments.

Reference: Palo Alto Networks Group Mapping documentation recommends using include group lists

for scenarios where only a subset of AD groups is required for policy enforcement.