Which type of role-based access is most appropriate for this project?

A super user is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups m their hierarchy to deploy policies and objects.

Which type of role-based access is most appropriate for this project?
A . Create a Dynamic Admin with the Panorama Administrator role.
B. Create a Device Group and Template Admin.
C. Create a Custom Panorama Admin.
D. Create a Dynamic Read only superuser

View Answer

Answer: B

Explanation:

A Device Group and Template Admin is a type of role-based access that allows the administrator to assign different privileges for different device groups and templates. This is useful for managing multiple firewalls with different configuration needs. For example, the administrator can create a Device Group and Template Admin role that allows the contractors to deploy policies and objects only to their assigned device groups and templates1. The other options are not suitable for this project. A Dynamic Admin with the Panorama Administrator role has full access to all device groups and templates2. A Custom Panorama Admin can have limited access to device groups and templates, but cannot have different privileges for different device groups and templates3. A Dynamic Read only superuser can only view the configuration and logs, but cannot

deploy policies and objects.

References:

1:

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/role-based-access-control/administrative-roles/device-group-and-template-admin

2: https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/role-based-access-control/administrative-roles/dynamic-admin

3: https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/role-based-access-control/administrative-roles/custom-panorama-admin :

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/role-based-access-control/administrative-roles/dynamic-read-only-superuser