NetSec-Architect Multi Cloud And Hybrid Network Security Architecture — 40 Questions

Question 1

You are architecting a Transit Gateway (TGW) design in AWS with centralized security using VM-Series firewalls in a security VPC. East-West traffic between Spoke VPCs must be inspected by the firewalls. Which AWS feature must be configured on the TGW route tables to ensure traffic destined to another Spoke VPC is intercepted and routed to the security VPC attachment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route table propagation with specific static routes pointing to the security VPC attachment. AWS Transit Gateway route tables must be configured with specific route associations and propagations, directing traffic from Spoke attachments toward the security VPC attachment for inspection.

Answer

AWS Network Firewall rules mirroring all traffic to the VM-Series interface

Answer

Security groups attached directly to the TGW attachment interface

Answer

Cross-region peering attachments with BGP enabled

Question 2

A security architect needs to license multiple VM-Series firewalls deployed dynamically across an auto-scaling AWS environment. Which licensing model is most appropriate to automate license procurement and revocation upon instance termination?

Accepted Answer

VM-Series AuthCode with Panorama AuthCodes / CSS (Cloud-Based Software Licensing). VM-Series AuthCodes tied to Panorama or VM-Series AuthCodes with VM-Series Bootstrap using Software-Defined Licensing (AuthCode/VM-Auth) or CSS (Cloud-Based Software Licensing) allows automatic license allocation.

Answer

Evaluating trial licenses that expire after 30 days without renewal

Answer

AuthCodes activated manually via the firewall web interface

Answer

Perpetual PAK licenses bound to physical MAC addresses

Question 3

An architect is troubleshooting asymmetric routing issues in a multi-region AWS deployment where VM-Series firewalls are deployed behind an AWS Gateway Load Balancer. The logs show drops due to 'tcp-non-syn'. What is the root cause and standard remediation?

Accepted Answer

Ensuring cross-zone load balancing is enabled on the GWLB target groups so flows return through the same firewall. Asymmetric routing occurs when return traffic bypasses the original firewall instance. With GWLB, flow stickiness is maintained using GENEVE flow hashes, but misconfigured routing tables or multiple AZ crossings can cause asymmetry.

Answer

Configuring static ARP entries on the VM-Series data interfaces

Answer

Disabling TCP SYN validation globally on the Panorama managed firewalls

Answer

Switching from AWS Gateway Load Balancer to an internal Application Load Balancer

Question 4

An enterprise deploys VM-Series firewalls in an Azure Hub-Spoke topology. Spoke VNets must communicate with each other exclusively through the hub VM-Series firewalls. What Azure construct prevents spoke VNets from bypassing the firewall by communicating directly via VNet peering?

Accepted Answer

Disabling 'Allow Forwarded Traffic' on the VNet peering settings and enforcing UDRs in spoke subnets. By default, Azure VNet peering allows direct traffic between peered VNets unless peerings are configured without gateway transit, or UDRs/Network Security Groups (NSGs) are used to block direct traffic, or peering routes are overridden.

Answer

Enabling Azure DDoS Protection Standard on all spoke subnets

Answer

Deploying Azure Bastion hosts in each spoke VNet

Answer

Configuring Azure ExpressRoute Global Reach between all spokes

Question 5

You are configuring Panorama to manage a fleet of VM-Series firewalls in AWS utilizing AWS Secrets Manager to dynamically retrieve API keys and external database credentials. Which Panorama feature enables this integration?

Accepted Answer

Panorama External Services / Secrets Engine integration. Panorama external services integration allows retrieval of secrets from AWS Secrets Manager or Azure Key Vault for use in API integrations and User-ID.

Answer

Log Collector syslog forwarding rules

Answer

WildFire cloud threat intelligence connector

Answer

GlobalProtect HIP object mapper

Question 6

You are configuring high availability for VM-Series firewalls deployed in AWS across multiple Availability Zones using AWS Lambda for HA failover. What event triggers the AWS Lambda function to initiate the failover sequence?

Accepted Answer

A CloudWatch metric alarm triggered by path monitoring failure invoking the Lambda function. AWS Lambda-based HA for VM-Series relies on the active firewall sending heartbeat or state change messages (or CloudWatch alarms triggered by interface status) to invoke the Lambda function.

Answer

An Amazon SNS email notification clicked by an administrator

Answer

A direct SNMP trap sent from the firewall management plane to AWS IAM

Answer

An AWS Trusted Advisor security check failure

Question 7

An organization has deployed VM-Series firewalls in Azure and requires all logs to be streamed in real-time to an external SIEM. Which Palo Alto Networks feature or architectural pattern should be used to stream logs directly from the firewalls to Azure Event Hubs?

Accepted Answer

Configuring an Azure Event Hubs Log Forwarding Profile on Panorama / VM-Series. Panorama or VM-Series firewalls support Log Forwarding to external destinations such as syslog, HTTPS, or Azure Event Hubs using Syslog or the Log Forwarding Profile.

Answer

Installing an Azure Log Analytics Agent inside the VM-Series PAN-OS kernel

Answer

Mounting an Azure Blob Storage container via NFS directly onto the firewall data plane

Answer

Using AWS CloudWatch log groups to capture Azure Event Hub traffic

Question 8

You are configuring Panorama to push template and device group settings to VM-Series firewalls deployed in AWS. A subset of firewalls requires a specific management IP gateway that differs from the default template. How should you handle this exception without creating an entirely new template?

Accepted Answer

Use Template Variables within the template and define specific variable values per device/serial number. Panorama templates support Template Variables, allowing administrators to define variables that can be overridden per device or device stack.

Answer

Modify the bootstrap init-cfg.txt file directly on running instances via SSH

Answer

Create a separate template stack and assign it to every individual firewall

Answer

Disable Panorama management on those specific firewalls and manage locally

Question 9

An architect is troubleshooting a high availability (HA) split-brain scenario in an active/passive VM-Series deployment in a public cloud. Which THREE factors or misconfigurations typically cause split-brain conditions in cloud HA environments? (Choose three)

Accepted Answer

Misconfigured path monitoring that fails to detect upstream routing failures.. Split-brain in a cloud VM-Series active/passive HA pair occurs when the two firewalls lose the ability to determine each other's health and both assume the active role. Option B is correct because path monitoring is the mechanism that detects upstream or downstream routing failures; if it is misconfigured (wrong source IP, destination, or interface), a firewall may fail to trigger a failover when the peer's path is actually broken, or may fail over spuriously, leading to both nodes claiming active. Option D is correct because the HA heartbeat (HA1 control and HA2 data links) depends on timely, reliable packet delivery; excessive packet loss or high latency on that path causes hello/keepalive messages to be missed, so each peer times out the other and promotes itself to active. Option E is correct because cloud Network Security Groups or firewall rules that block the UDP/TCP ports used by HA1 (typically UDP 28260/28261 for control and 28262 for HA2 data, plus ICMP for path monitoring) prevent heartbeats from traversing, which directly produces the split-brain condition. Option A does not belong because running different PAN-OS minor patch versions is a supported, common practice and does not by itself cause split-brain; version mismatch may affect feature parity but not HA heartbeat state. Option C does not belong because VM-Series data plane interfaces in public clouds use cloud-assigned MAC addresses and the hypervisor handles L2 forwarding; identical MAC addresses are not a typical split-brain cause in cloud HA deployments.

Answer

Running different PAN-OS minor patch versions on the HA pair for an extended period.

Answer

Using identical MAC addresses on all data plane interfaces without cloud hypervisor support.

Question 10

You are architecting a multi-cloud environment with a hub-and-spoke topology in Google Cloud Platform. The central hub VPC contains a pair of VM-Series firewalls that must inspect traffic from multiple spoke VPCs. You need to ensure that spoke VPCs can route traffic to the firewall's internal and external interfaces without requiring additional static routes in each spoke. Which GCP feature should you implement?

Accepted Answer

Shared VPC. In GCP, Shared VPC centralizes network administration and allows resources in service projects to use routes defined in the host project. When VM-Series firewalls reside in the host project, custom routes with instance next hops are available to all service projects, enabling spoke traffic to be redirected to the firewalls without per-spoke routes. This design is essential for scalable hub-and-spoke security architectures.

Answer

VPC Network Peering

Answer

Cloud VPN

Answer

Cloud Interconnect

Question 11

You are designing a hybrid cloud network where an on-premises datacenter connects to an Azure VNet using ExpressRoute, and to an AWS VPC using AWS Site-to-Site VPN. You need to ensure that traffic between the on-premises network and both clouds is secured and inspected by VM-Series firewalls. Which two design elements are required to achieve this? (Choose two.)

Accepted Answer

Configure ExpressRoute and Site-to-Site VPN to terminate directly on the VM-Series firewalls to enable decryption and inspection.. To secure and inspect traffic between on-premises and multiple clouds, VM-Series firewalls must be deployed in transit networks in each cloud, and the hybrid connections (ExpressRoute and VPN) must terminate on those firewalls. This ensures all traffic passes through the firewalls for inspection. Peering and routing are supporting but not the core required elements.

Answer

Configure VNet peering between the transit VNet and workload VNets, and VPC peering between the transit VPC and workload VPCs, with user-defined routes to direct traffic.

Answer

Enable Azure DDoS Protection Standard on the VNet and AWS Shield Advanced on the VPC to secure the hybrid connections.

Answer

Use Azure Firewall in the VNet and AWS Network Firewall in the VPC instead of VM-Series firewalls for consistent policy.

Question 12

Your organization runs a hub-and-spoke network in Microsoft Azure with a VM-Series firewall in the hub VNet performing inspection between spokes. A new partner VNet will be peered to the hub, and you must ensure that traffic from the partner VNet to any spoke is inspected by the firewall before reaching the spoke. The partner VNet is in a different Azure subscription. What should you configure?

Accepted Answer

Enable 'Allow forwarded traffic' on the hub-to-partner peering and configure a user-defined route (UDR) in the partner VNet subnet pointing to the firewall's private IP as the next hop.. To force partner-to-spoke traffic through the VM-Series, the partner subnet needs a UDR with the firewall as next hop, and the peering must allow forwarded traffic so the firewall can receive packets not destined to its own IP. Without the UDR, traffic follows the system route directly to the spoke. Without forwarded traffic, the hub drops packets that are not addressed to the firewall.

Answer

Configure Azure Firewall in the hub VNet and use Azure Firewall Manager to apply a security policy to the partner VNet.

Answer

Create a VNet-to-VNet VPN connection between the partner VNet and the hub VNet, and use the firewall as the VPN gateway.

Answer

Enable 'Use remote gateways' on the partner VNet peering and advertise the spoke address space from the hub's VPN gateway.

Question 13

A security architect is deploying VM-Series firewalls in AWS to inspect traffic between multiple VPCs using AWS Transit Gateway. The architect wants to ensure that traffic between VPCs is inspected by the firewall, but also wants to minimize the number of firewall instances and avoid asymmetric routing. Which AWS Transit Gateway attachment and routing configuration should be used?

Accepted Answer

Attach the VM-Series firewall to a dedicated inspection VPC, and configure Transit Gateway route tables to send all inter-VPC traffic to the firewall attachment. Deploy the firewall in an Auto Scaling group across multiple Availability Zones.. The correct design uses a dedicated inspection VPC with VM-Series firewalls attached to AWS Transit Gateway. Transit Gateway route tables direct all inter-VPC traffic to the firewall attachment, ensuring inspection. Deploying the firewall in an Auto Scaling group across multiple Availability Zones provides high availability and scalability, and helps avoid asymmetric routing by maintaining symmetric traffic flows through the firewall.

Answer

Attach each VPC directly to the VM-Series firewall using VPC peering, and configure route tables in each VPC to send traffic to the firewall's ENI.

Answer

Attach the VM-Series firewall to a dedicated inspection VPC, and configure Transit Gateway route tables to send all inter-VPC traffic to the firewall attachment. Use a single firewall instance with multiple ENIs.

Answer

Use AWS Gateway Load Balancer to distribute traffic to VM-Series firewalls, and configure Transit Gateway to route all traffic to the Gateway Load Balancer endpoint.

Question 14

An architect is designing a hybrid cloud network where an on-premises data center connects to an Azure VNet via ExpressRoute. The security team requires that all traffic between on-premises and Azure be inspected by VM-Series firewalls deployed in Azure, and that the firewalls be highly available. Which TWO design elements are required to meet these requirements? (Choose two.)

Accepted Answer

Deploy the VM-Series firewalls in an availability set or across Availability Zones, and use Azure Load Balancer in HA Ports mode to distribute traffic.. To inspect traffic between on-premises and Azure via ExpressRoute, User-Defined Routes must be configured to force traffic through the VM-Series firewall. For high availability, the firewalls must be deployed across Availability Zones or in an availability set, and Azure Load Balancer in HA Ports mode is required to distribute traffic and provide failover.

Answer

Configure a site-to-site VPN as a backup to ExpressRoute and have the VM-Series firewalls terminate the VPN tunnels.

Answer

Enable Azure DDoS Protection Standard on the VNet and configure the VM-Series firewalls to inspect all inbound traffic.

Answer

Configure the ExpressRoute circuit with a private peering and enable BGP route propagation to the VM-Series firewalls.

Question 15

A network security architect is designing a hybrid cloud environment where an on-premises Palo Alto Networks firewall cluster must inspect traffic between an Azure VNet and an on-premises datacenter connected via ExpressRoute. The architect wants to ensure that all traffic between the VNet and on-premises is inspected by the on-premises firewall without asymmetric routing. The VNet has a gateway subnet with a VPN gateway. Which design should the architect choose?

Accepted Answer

Configure the on-premises firewall as the next hop for the VNet's gateway subnet using user-defined routes, and ensure the firewall is in a separate subnet with IP forwarding enabled, while the VPN gateway advertises the on-premises routes.. To inspect traffic between an Azure VNet and on-premises over ExpressRoute, the on-premises firewall must be inserted as the next hop for the VNet's gateway subnet using user-defined routes. This ensures that traffic from the VNet is directed to the firewall for inspection before reaching the on-premises network. The firewall must have IP forwarding enabled and reside in a separate subnet. This design maintains symmetric routing and meets the security requirement.

Answer

Deploy an Azure Firewall in the VNet and configure it to forward all traffic to the on-premises firewall via ExpressRoute, using Azure Firewall as the next hop for user-defined routes.

Answer

Deploy the on-premises firewall in a transparent bridge mode between the ExpressRoute circuit and the internal network, and configure the VNet to route all traffic to the on-premises firewall via user-defined routes.

Answer

Use ExpressRoute Global Reach to connect the on-premises network directly to the VNet, and configure the on-premises firewall to inspect traffic by placing it in the path between the ExpressRoute circuit and the on-premises core switch.

Question 16

An organization is deploying VM-Series firewalls in Microsoft Azure to secure traffic between multiple virtual networks (VNets) in a hub-and-spoke topology. The security team wants to ensure that all inter-spoke traffic is inspected by the firewall without requiring complex user-defined routes (UDRs) in each spoke VNet. Which Azure feature should the architect use?

Accepted Answer

Azure Route Server. Azure Route Server integrates with network virtual appliances (NVAs) like VM-Series to exchange routes dynamically. When the firewall peers with Route Server, it can advertise routes for the spoke VNets, and Route Server injects these into the VNets' effective routes. This eliminates the need for manual UDRs in each spoke, as the routes are propagated automatically. This design simplifies operations and ensures all inter-spoke traffic is inspected by the firewall.

Answer

Azure Firewall Manager

Answer

Azure Virtual Network Peering with gateway transit

Answer

Azure Private Link

Question 17

A network security architect is designing a multi-cloud environment with VM-Series firewalls in AWS and Azure. They need to ensure that security policies are consistently applied across both clouds. Which Palo Alto Networks solution should they use to centrally manage policies and configurations for all VM-Series firewalls?

Accepted Answer

Panorama in panorama mode. Panorama in panorama mode is the centralized management solution for Palo Alto Networks firewalls, including VM-Series. It enables consistent policy and configuration across multiple firewalls in different clouds. Other options are either not real modes or serve different purposes, such as cloud security posture or SASE.

Answer

Panorama in management mode

Answer

Prisma Access

Answer

Cloud Native Application Protection Platform (CNAPP)

Question 18

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. The architect wants to centralize policy management and logging across both clouds. Which solution should be used?

Accepted Answer

Deploy Panorama in a cloud-neutral location with private connectivity to both AWS and Azure, such as using AWS Transit Gateway and Azure ExpressRoute, and configure all VM-Series firewalls to connect to it.. Centralized management and logging across AWS and Azure require Panorama to have private, reliable connectivity to all VM-Series firewalls. Deploying Panorama in a cloud-neutral location with private connections such as AWS Transit Gateway and Azure ExpressRoute ensures secure communication and consistent policy enforcement. This design avoids exposing management interfaces to the public internet and supports scalability.

Answer

Deploy Panorama in one cloud and use a site-to-site VPN to connect the other cloud's firewalls for management and logging.

Answer

Deploy Panorama on-premises and configure each VM-Series firewall to connect to it for policy and logging.

Answer

Deploy Panorama in AWS and configure Azure VM-Series firewalls to connect to it over the public internet.

Question 19

An architect is troubleshooting asymmetric routing in a hybrid cloud environment where VM-Series firewalls in AWS inspect traffic between an on-premises data center and a VPC. The traffic enters the firewall from the VPN attachment via a transit gateway, but return traffic from the VPC is bypassing the firewall. Which configuration change is most likely to resolve this issue?

Accepted Answer

Enable appliance mode on the transit gateway attachment for the firewall VPC.. In AWS transit gateway deployments, appliance mode must be enabled on the attachment for the VPC that hosts the VM-Series firewall. Appliance mode ensures that traffic flows are symmetric by using the sameAvailability Zone and firewall instance for both directions. Without it, return traffic may be routed to a different firewall instance or bypass the firewall entirely, leading to asymmetric routing and potential session drops. Enabling appliance mode is the correct solution.

Answer

Disable source/destination check on the firewall's ENI.

Answer

Configure policy-based routing on the VM-Series firewall to force return traffic through the same interface.

Answer

Add a route in the VPC route table pointing to the firewall's ENI for the on-premises CIDR.

Question 20

You are designing a hybrid network where an on-premises datacenter connects to an Azure VNet via ExpressRoute. You need to ensure that traffic between on-premises and Azure is inspected by a VM-Series firewall deployed in Azure. What is the correct way to route traffic through the firewall?

Accepted Answer

Create a UDR on the workload subnets that points to the VM-Series firewall's untrusted interface as the next hop for on-premises destinations.. To route traffic from Azure workloads to on-premises through a VM-Series firewall, you must create a user-defined route on the workload subnets that directs traffic destined for on-premises to the firewall's interface as the next hop. This forces inspection. UDRs on the GatewaySubnet are not recommended and can disrupt the gateway.

Answer

Create a user-defined route (UDR) on the GatewaySubnet that points to the VM-Series firewall's trusted interface as the next hop.

Answer

Configure VNet peering between the workload VNet and the GatewaySubnet VNet, and enable traffic forwarding on the firewall's NIC.

Answer

Enable Azure Route Server and configure BGP peering between the VM-Series firewall and the ExpressRoute gateway to advertise routes.