What are two methods that a NGFW uses to determine if submitted credentials are valid...

LDAP Query (Answer B):

Palo Alto Networks NGFWs can queryLDAP directories(such as Active Directory) to validate whether submitted credentials match the corporate directory.

Domain Credential Filter (Answer C):

TheDomain Credential Filterfeature ensures that submitted credentials are checked against valid corporate credentials, preventing credential misuse.

Why Not A:

Group mappingis used to identify user groups for policy enforcement but does not validate submitted credentials.

Why Not D:

WMI client probingis used for user identification but is not a method for validating submitted credentials.

References from Palo Alto Networks Documentation:

Credential Theft Prevention