Exam SSE-Engineer Topic 3 Question 67 Discussion

The Cloud Identity Engine functions as an identity broker and profile source, but it does not directly authenticate mobile users on Prisma Access ' s behalf by itself - the actual authentication enforcement point for GlobalProtect mobile users lives in Strata Cloud Manager ' s own authentication profile object, which must be created there and explicitly linked back to the SAML profile already built in the Cloud Identity Engine application. This linkage is what allows Strata Cloud Manager to reference the IdP metadata, certificates, and attribute mappings the Cloud Identity Engine has already established, without duplicating that configuration, and it is the documented, required next step once the Cloud Identity Engine side of the setup is complete - making option D correct. Performing a " full commit " (option A) is not how Cloud Identity Engine profiles become usable for authentication; a commit pushes configuration changes to devices, it does not perform a discovery-and-synchronization step that magically surfaces an unlinked SAML profile for mobile user authentication. Granting the Cloud Identity Engine service account RBAC access to the mobile user folder (option B) describes a permissions structure that is not part of the documented authentication configuration workflow and does not, by itself, wire up SAML for mobile users. There is no authentication type literally named " Cloud Identity Engine " to select in Strata Cloud Manager (option C); the authentication profile type remains SAML, referencing the Cloud Identity Engine as its source, not " Cloud Identity Engine " as a discrete authentication type.
Reference:Strata Cloud Manager - Configure SAML Authentication for Mobile Users via Cloud Identity Engine.