Which two methods are valid ways to populate user-to-IP mappings? (Choose two.)

Populating user-to-IP mappings is a critical function for enabling user-based policy enforcement in

Palo Alto Networks firewalls. The following two methods are valid ways to populate these mappings:

Why "XML API" (Correct Answer A)?

The XML API allows external systems to programmatically send user-to-IP mapping information to

the firewall. This is a highly flexible method, particularly when user information is available from an

external system that integrates via the API. This method is commonly used in environments where

the mapping data is maintained in a centralized database or monitoring system.

Why "User-ID" (Correct Answer C)?

User-ID is a core feature of Palo Alto Networks firewalls that allows for the dynamic identification of

users and their corresponding IP addresses. User-ID agents can pull this data from various sources,

such as Active Directory, Syslog servers, and more. This is one of the most common and reliable

methods to maintain user-to-IP mappings.

Why not "Captive portal" (Option B)?

Captive portal is a mechanism for authenticating users when they access the network. While it can

indirectly contribute to user-to-IP mapping, it is not a direct method to populate these mappings.

Instead, it prompts users to authenticate, after which User-ID handles the mapping.

Why not "SCP log ingestion" (Option D)?

SCP (Secure Copy Protocol) is a file transfer protocol and does not have any functionality related to

populating user-to-IP mappings. Log ingestion via SCP is not a valid way to map users to IP addresses.

Reference: Palo Alto Networks documentation on User-ID confirms that the XML API and User-ID are

two valid methods for populating user-to-IP mappings.