NetSec-Architect Multi Cloud And Hybrid Network Security Architecture — All Questions With Answers

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are architecting a Transit Gateway (TGW) design in AWS with centralized security using VM-Series firewalls in a security VPC. East-West traffic between Spoke VPCs must be inspected by the firewalls. Which AWS feature must be configured on the TGW route tables to ensure traffic destined to another Spoke VPC is intercepted and routed to the security VPC attachment?

Question 2easymultiple choice

A security architect needs to license multiple VM-Series firewalls deployed dynamically across an auto-scaling AWS environment. Which licensing model is most appropriate to automate license procurement and revocation upon instance termination?

Question 3hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is troubleshooting asymmetric routing issues in a multi-region AWS deployment where VM-Series firewalls are deployed behind an AWS Gateway Load Balancer. The logs show drops due to 'tcp-non-syn'. What is the root cause and standard remediation?

Question 4mediummultiple choice

An enterprise deploys VM-Series firewalls in an Azure Hub-Spoke topology. Spoke VNets must communicate with each other exclusively through the hub VM-Series firewalls. What Azure construct prevents spoke VNets from bypassing the firewall by communicating directly via VNet peering?

Question 5hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring Panorama to manage a fleet of VM-Series firewalls in AWS utilizing AWS Secrets Manager to dynamically retrieve API keys and external database credentials. Which Panorama feature enables this integration?

Question 6hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring high availability for VM-Series firewalls deployed in AWS across multiple Availability Zones using AWS Lambda for HA failover. What event triggers the AWS Lambda function to initiate the failover sequence?

Question 7hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An organization has deployed VM-Series firewalls in Azure and requires all logs to be streamed in real-time to an external SIEM. Which Palo Alto Networks feature or architectural pattern should be used to stream logs directly from the firewalls to Azure Event Hubs?

Question 8mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring Panorama to push template and device group settings to VM-Series firewalls deployed in AWS. A subset of firewalls requires a specific management IP gateway that differs from the default template. How should you handle this exception without creating an entirely new template?

Question 9hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is troubleshooting a high availability (HA) split-brain scenario in an active/passive VM-Series deployment in a public cloud. Which THREE factors or misconfigurations typically cause split-brain conditions in cloud HA environments? (Choose three)

Question 10mediummultiple choice

You are architecting a multi-cloud environment with a hub-and-spoke topology in Google Cloud Platform. The central hub VPC contains a pair of VM-Series firewalls that must inspect traffic from multiple spoke VPCs. You need to ensure that spoke VPCs can route traffic to the firewall's internal and external interfaces without requiring additional static routes in each spoke. Which GCP feature should you implement?

Question 11hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a hybrid cloud network where an on-premises datacenter connects to an Azure VNet using ExpressRoute, and to an AWS VPC using AWS Site-to-Site VPN. You need to ensure that traffic between the on-premises network and both clouds is secured and inspected by VM-Series firewalls. Which two design elements are required to achieve this? (Choose two.)

Question 12mediummultiple choice

Your organization runs a hub-and-spoke network in Microsoft Azure with a VM-Series firewall in the hub VNet performing inspection between spokes. A new partner VNet will be peered to the hub, and you must ensure that traffic from the partner VNet to any spoke is inspected by the firewall before reaching the spoke. The partner VNet is in a different Azure subscription. What should you configure?

Question 13hardmultiple choice

A security architect is deploying VM-Series firewalls in AWS to inspect traffic between multiple VPCs using AWS Transit Gateway. The architect wants to ensure that traffic between VPCs is inspected by the firewall, but also wants to minimize the number of firewall instances and avoid asymmetric routing. Which AWS Transit Gateway attachment and routing configuration should be used?

Question 14mediummulti select

An architect is designing a hybrid cloud network where an on-premises data center connects to an Azure VNet via ExpressRoute. The security team requires that all traffic between on-premises and Azure be inspected by VM-Series firewalls deployed in Azure, and that the firewalls be highly available. Which TWO design elements are required to meet these requirements? (Choose two.)

Question 15hardmultiple choice

A network security architect is designing a hybrid cloud environment where an on-premises Palo Alto Networks firewall cluster must inspect traffic between an Azure VNet and an on-premises datacenter connected via ExpressRoute. The architect wants to ensure that all traffic between the VNet and on-premises is inspected by the on-premises firewall without asymmetric routing. The VNet has a gateway subnet with a VPN gateway. Which design should the architect choose?

Question 16easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An organization is deploying VM-Series firewalls in Microsoft Azure to secure traffic between multiple virtual networks (VNets) in a hub-and-spoke topology. The security team wants to ensure that all inter-spoke traffic is inspected by the firewall without requiring complex user-defined routes (UDRs) in each spoke VNet. Which Azure feature should the architect use?

Question 17easymultiple choice

A network security architect is designing a multi-cloud environment with VM-Series firewalls in AWS and Azure. They need to ensure that security policies are consistently applied across both clouds. Which Palo Alto Networks solution should they use to centrally manage policies and configurations for all VM-Series firewalls?

Question 18mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. The architect wants to centralize policy management and logging across both clouds. Which solution should be used?

Question 19hardmultiple choice

An architect is troubleshooting asymmetric routing in a hybrid cloud environment where VM-Series firewalls in AWS inspect traffic between an on-premises data center and a VPC. The traffic enters the firewall from the VPN attachment via a transit gateway, but return traffic from the VPC is bypassing the firewall. Which configuration change is most likely to resolve this issue?

Question 20mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a hybrid network where an on-premises datacenter connects to an Azure VNet via ExpressRoute. You need to ensure that traffic between on-premises and Azure is inspected by a VM-Series firewall deployed in Azure. What is the correct way to route traffic through the firewall?

Question 21hardmulti select

An architect is deploying VM-Series firewalls in Google Cloud Platform (GCP) to inspect traffic between multiple VPC networks. The architect plans to use a hub-and-spoke topology with a central inspection VPC. Which TWO GCP features or configurations are required to ensure that traffic between spoke VPCs is inspected by the firewall? (Choose two.)

Question 22mediummultiple choice

A security architect is designing a hybrid network where an on-premises data center connects to an AWS VPC using AWS Site-to-Site VPN. The architect wants to inspect all traffic between the on-premises network and the VPC using VM-Series firewalls deployed in AWS. The firewalls are deployed in a single subnet with one ENI for management and one ENI for data. Which AWS VPC route table configuration is required to ensure that traffic from the VPN gateway is inspected by the firewall?

Question 23hardmultiple choice

You manage a hybrid network where an on-premises datacenter connects to Google Cloud via Cloud VPN. You have VM-Series firewalls in a GCP VPC performing inspection for workloads in multiple subnets. You need to ensure that traffic from on-premises to any workload subnet is inspected, and that return traffic follows the same path. Which combination of GCP components should you use?

Question 24easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a multi-cloud architecture where AWS workloads must securely access Azure services over the public internet. You want to use VM-Series firewalls in both clouds to inspect traffic and enforce security policies. Which AWS feature should you use to route traffic from an AWS VPC to the VM-Series for inspection before it goes to Azure?

Question 25mediummulti select

You are deploying VM-Series firewalls in a multi-cloud environment consisting of AWS and Azure. You need to ensure that the firewalls can inspect traffic between the two clouds and that management traffic is separated from data traffic. Which TWO design considerations are required to achieve this? (Choose two.)

Question 26hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

A security architect is deploying VM-Series firewalls in a multi-cloud environment spanning AWS and Azure. The architect needs to ensure that traffic between the two clouds is inspected by the firewalls and that the solution supports active/active high availability across clouds. Which design consideration is most critical for achieving cross-cloud active/active HA?

Question 27mediummultiple choice

An architect is designing a hybrid cloud network where an on-premises data center connects to both AWS and Azure using IPSec VPNs. The architect wants to ensure that if the primary VPN tunnel to AWS fails, traffic automatically fails over to a secondary tunnel to Azure, and vice versa. Which Palo Alto Networks feature should be used to achieve this dynamic path selection?

Question 28easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Question 29easymultiple choice

An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?

Question 30hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

Question 31hardmultiple choice

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

Question 32mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

Question 33mediummultiple choice

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

Question 34mediummultiple choice

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

Question 35easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

Question 36easymultiple choice

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

Question 37easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

What is the primary function of the VM-Series plugin for Panorama?

Question 38mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

Question 39hardmultiple choice

Read the full DHCP explanation →

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

Question 40easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

Question 41mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

Question 42easymultiple choice

Study the full virtualization explanation →

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

Question 43hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Question 44easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Question 45mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

Question 46easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

Question 47hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

Question 48hardmulti select

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

Question 49mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

Question 50mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

Question 51hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

Question 52mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

Question 53mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

Question 54hardmulti select

When designing a secure multi-cloud transit architecture with VM-Series firewalls across AWS, Azure, and GCP, which THREE architectural best practices should an architect follow? (Choose three)

Question 55mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

Question 56hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

Question 57mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO log types can be forwarded directly from VM-Series firewalls or Panorama to external SIEM or analytics platforms in a multi-cloud architecture? (Choose two)

Question 58hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Question 59mediummultiple choice

Open the full BGP breakdown →

You are designing a hybrid architecture where an on-premises Palo Alto Networks PA-5220 firewall connects to an AWS VPC over a Site-to-Site VPN. The on-premises firewall is behind a NAT device that does not preserve source ports. You must ensure that the VPN tunnel establishes and remains stable. Which configuration should you apply on the VM-Series firewall in AWS?

Question 60mediummultiple choice

A NetSec-Architect is designing a hybrid connectivity solution where an on-premises data center must connect to both an AWS Transit Gateway and a Microsoft Azure Virtual WAN. The security team requires that all traffic between on-premises and each cloud be inspected by VM-Series firewalls deployed in the respective cloud, and that the on-premises router only maintain a single BGP peering with each cloud. Which design meets these requirements?

Question 61hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing security for a multi-cloud environment where workloads in AWS and Azure must communicate securely. The design uses VM-Series firewalls in each cloud, and traffic between clouds traverses the public internet. The requirement is to ensure that inter-cloud traffic is encrypted and that the firewalls can inspect the traffic for threats. Which solution should the architect implement?

Question 62mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a hybrid environment where an on-premises data center connects to an Azure Virtual Network (VNet) using a site-to-site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VNet be inspected by a VM-Series firewall deployed in Azure. The firewall must also inspect traffic between subnets within the VNet. Which Azure VNet configuration is required to meet these requirements?

Question 63hardmultiple choice

An architect is designing a multi-cloud environment where VM-Series firewalls in AWS and Azure must share consistent security policies and object definitions. The requirements include centralized policy management, logging to a single SIEM, and the ability to push policy updates to all firewalls simultaneously. Which solution should the architect implement?

Question 64mediummultiple choice

An architect is connecting an on-premises Palo Alto Networks PA-Series firewall cluster to an AWS VPC using AWS Site-to-Site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the on-premises firewall initiate the IPsec tunnel. The VPC has a virtual private gateway attached. Which configuration should the architect implement on the on-premises firewall to meet these requirements?

Question 65easymultiple choice

An organization is deploying VM-Series firewalls in Google Cloud Platform (GCP) to secure traffic between multiple VPC networks. The architect needs to ensure that the firewalls can inspect traffic between VPCs and that the design supports high availability. Which GCP feature should be used to route traffic through the VM-Series firewalls?

Question 66mediummultiple choice

An architect is designing a multi-cloud network where a Palo Alto Networks VM-Series firewall in AWS must establish an IPsec VPN tunnel to a VM-Series firewall in Google Cloud. Both firewalls are behind NAT devices. The architect needs to ensure that the VPN tunnel can be established despite the NAT. Which configuration should be used on both firewalls?

Question 67easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is deploying a VM-Series firewall in Microsoft Azure to secure traffic between two VNets in a hub-and-spoke topology. The architect wants to ensure that traffic between the spokes is inspected by the firewall in the hub VNet. Which Azure feature should be used to route traffic from the spokes to the firewall?

Question 68hardmulti select

An architect is designing a hybrid cloud security architecture where an on-premises Palo Alto Networks firewall must inspect traffic between an AWS VPC and an on-premises datacenter. The VPC uses a Transit Gateway to connect multiple VPCs. The architect wants to ensure that all traffic from the VPCs to on-premises is inspected by the on-premises firewall. Which TWO design considerations are required to achieve this? (Choose two.)

Question 69mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a multi-cloud environment where an on-premises Palo Alto Networks PA-Series firewall must inspect traffic between an AWS VPC and a GCP VPC. The architect wants to use a single, centrally managed security policy across both cloud environments. Which Palo Alto Networks feature should the architect implement to achieve consistent policy enforcement across AWS and GCP?

Question 70easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is deploying VM-Series firewalls in a multi-cloud environment that includes AWS and Azure. The architect wants to ensure that security policies are consistently applied to traffic flowing between the clouds. Which Palo Alto Networks solution provides centralized policy management and visibility across all cloud deployments?

Question 71hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a multi-cloud network with VM-Series firewalls in AWS and Azure, managed by Panorama. The architect needs to ensure that security policies are consistently enforced and that traffic between clouds is inspected. Which two design elements are required to achieve this? (Choose two.)

Question 1mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are architecting a Transit Gateway (TGW) design in AWS with centralized security using VM-Series firewalls in a security VPC. East-West traffic between Spoke VPCs must be inspected by the firewalls. Which AWS feature must be configured on the TGW route tables to ensure traffic destined to another Spoke VPC is intercepted and routed to the security VPC attachment?

Question 2easymultiple choice

A security architect needs to license multiple VM-Series firewalls deployed dynamically across an auto-scaling AWS environment. Which licensing model is most appropriate to automate license procurement and revocation upon instance termination?

Question 3hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is troubleshooting asymmetric routing issues in a multi-region AWS deployment where VM-Series firewalls are deployed behind an AWS Gateway Load Balancer. The logs show drops due to 'tcp-non-syn'. What is the root cause and standard remediation?

Question 4mediummultiple choice

An enterprise deploys VM-Series firewalls in an Azure Hub-Spoke topology. Spoke VNets must communicate with each other exclusively through the hub VM-Series firewalls. What Azure construct prevents spoke VNets from bypassing the firewall by communicating directly via VNet peering?

Question 5hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring Panorama to manage a fleet of VM-Series firewalls in AWS utilizing AWS Secrets Manager to dynamically retrieve API keys and external database credentials. Which Panorama feature enables this integration?

Question 6hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring high availability for VM-Series firewalls deployed in AWS across multiple Availability Zones using AWS Lambda for HA failover. What event triggers the AWS Lambda function to initiate the failover sequence?

Question 7hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An organization has deployed VM-Series firewalls in Azure and requires all logs to be streamed in real-time to an external SIEM. Which Palo Alto Networks feature or architectural pattern should be used to stream logs directly from the firewalls to Azure Event Hubs?

Question 8mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring Panorama to push template and device group settings to VM-Series firewalls deployed in AWS. A subset of firewalls requires a specific management IP gateway that differs from the default template. How should you handle this exception without creating an entirely new template?

Question 9hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is troubleshooting a high availability (HA) split-brain scenario in an active/passive VM-Series deployment in a public cloud. Which THREE factors or misconfigurations typically cause split-brain conditions in cloud HA environments? (Choose three)

Question 10mediummultiple choice

You are architecting a multi-cloud environment with a hub-and-spoke topology in Google Cloud Platform. The central hub VPC contains a pair of VM-Series firewalls that must inspect traffic from multiple spoke VPCs. You need to ensure that spoke VPCs can route traffic to the firewall's internal and external interfaces without requiring additional static routes in each spoke. Which GCP feature should you implement?

Question 11hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a hybrid cloud network where an on-premises datacenter connects to an Azure VNet using ExpressRoute, and to an AWS VPC using AWS Site-to-Site VPN. You need to ensure that traffic between the on-premises network and both clouds is secured and inspected by VM-Series firewalls. Which two design elements are required to achieve this? (Choose two.)

Question 12mediummultiple choice

Your organization runs a hub-and-spoke network in Microsoft Azure with a VM-Series firewall in the hub VNet performing inspection between spokes. A new partner VNet will be peered to the hub, and you must ensure that traffic from the partner VNet to any spoke is inspected by the firewall before reaching the spoke. The partner VNet is in a different Azure subscription. What should you configure?

Question 13hardmultiple choice

A security architect is deploying VM-Series firewalls in AWS to inspect traffic between multiple VPCs using AWS Transit Gateway. The architect wants to ensure that traffic between VPCs is inspected by the firewall, but also wants to minimize the number of firewall instances and avoid asymmetric routing. Which AWS Transit Gateway attachment and routing configuration should be used?

Question 14mediummulti select

An architect is designing a hybrid cloud network where an on-premises data center connects to an Azure VNet via ExpressRoute. The security team requires that all traffic between on-premises and Azure be inspected by VM-Series firewalls deployed in Azure, and that the firewalls be highly available. Which TWO design elements are required to meet these requirements? (Choose two.)

Question 15hardmultiple choice

A network security architect is designing a hybrid cloud environment where an on-premises Palo Alto Networks firewall cluster must inspect traffic between an Azure VNet and an on-premises datacenter connected via ExpressRoute. The architect wants to ensure that all traffic between the VNet and on-premises is inspected by the on-premises firewall without asymmetric routing. The VNet has a gateway subnet with a VPN gateway. Which design should the architect choose?

Question 16easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An organization is deploying VM-Series firewalls in Microsoft Azure to secure traffic between multiple virtual networks (VNets) in a hub-and-spoke topology. The security team wants to ensure that all inter-spoke traffic is inspected by the firewall without requiring complex user-defined routes (UDRs) in each spoke VNet. Which Azure feature should the architect use?

Question 17easymultiple choice

A network security architect is designing a multi-cloud environment with VM-Series firewalls in AWS and Azure. They need to ensure that security policies are consistently applied across both clouds. Which Palo Alto Networks solution should they use to centrally manage policies and configurations for all VM-Series firewalls?

Question 18mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. The architect wants to centralize policy management and logging across both clouds. Which solution should be used?

Question 19hardmultiple choice

An architect is troubleshooting asymmetric routing in a hybrid cloud environment where VM-Series firewalls in AWS inspect traffic between an on-premises data center and a VPC. The traffic enters the firewall from the VPN attachment via a transit gateway, but return traffic from the VPC is bypassing the firewall. Which configuration change is most likely to resolve this issue?

Question 20mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a hybrid network where an on-premises datacenter connects to an Azure VNet via ExpressRoute. You need to ensure that traffic between on-premises and Azure is inspected by a VM-Series firewall deployed in Azure. What is the correct way to route traffic through the firewall?

Question 21hardmulti select

An architect is deploying VM-Series firewalls in Google Cloud Platform (GCP) to inspect traffic between multiple VPC networks. The architect plans to use a hub-and-spoke topology with a central inspection VPC. Which TWO GCP features or configurations are required to ensure that traffic between spoke VPCs is inspected by the firewall? (Choose two.)

Question 22mediummultiple choice

A security architect is designing a hybrid network where an on-premises data center connects to an AWS VPC using AWS Site-to-Site VPN. The architect wants to inspect all traffic between the on-premises network and the VPC using VM-Series firewalls deployed in AWS. The firewalls are deployed in a single subnet with one ENI for management and one ENI for data. Which AWS VPC route table configuration is required to ensure that traffic from the VPN gateway is inspected by the firewall?

Question 23hardmultiple choice

You manage a hybrid network where an on-premises datacenter connects to Google Cloud via Cloud VPN. You have VM-Series firewalls in a GCP VPC performing inspection for workloads in multiple subnets. You need to ensure that traffic from on-premises to any workload subnet is inspected, and that return traffic follows the same path. Which combination of GCP components should you use?

Question 24easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a multi-cloud architecture where AWS workloads must securely access Azure services over the public internet. You want to use VM-Series firewalls in both clouds to inspect traffic and enforce security policies. Which AWS feature should you use to route traffic from an AWS VPC to the VM-Series for inspection before it goes to Azure?

Question 25mediummulti select

You are deploying VM-Series firewalls in a multi-cloud environment consisting of AWS and Azure. You need to ensure that the firewalls can inspect traffic between the two clouds and that management traffic is separated from data traffic. Which TWO design considerations are required to achieve this? (Choose two.)

Question 26hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

A security architect is deploying VM-Series firewalls in a multi-cloud environment spanning AWS and Azure. The architect needs to ensure that traffic between the two clouds is inspected by the firewalls and that the solution supports active/active high availability across clouds. Which design consideration is most critical for achieving cross-cloud active/active HA?

Question 27mediummultiple choice

An architect is designing a hybrid cloud network where an on-premises data center connects to both AWS and Azure using IPSec VPNs. The architect wants to ensure that if the primary VPN tunnel to AWS fails, traffic automatically fails over to a secondary tunnel to Azure, and vice versa. Which Palo Alto Networks feature should be used to achieve this dynamic path selection?

Question 28easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Question 29easymultiple choice

An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?

Question 30hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

Question 31hardmultiple choice

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

Question 32mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

Question 33mediummultiple choice

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

Question 34mediummultiple choice

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

Question 35easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

Question 36easymultiple choice

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

Question 37easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

What is the primary function of the VM-Series plugin for Panorama?

Question 38mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

Question 39hardmultiple choice

Read the full DHCP explanation →

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

Question 40easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

Question 41mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

Question 42easymultiple choice

Study the full virtualization explanation →

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

Question 43hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Question 44easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Question 45mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

Question 46easymultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

Question 47hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

Question 48hardmulti select

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

Question 49mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

Question 50mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

Question 51hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

Question 52mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

Question 53mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

Question 54hardmulti select

When designing a secure multi-cloud transit architecture with VM-Series firewalls across AWS, Azure, and GCP, which THREE architectural best practices should an architect follow? (Choose three)

Question 55mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

Question 56hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

Question 57mediummulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

Which TWO log types can be forwarded directly from VM-Series firewalls or Panorama to external SIEM or analytics platforms in a multi-cloud architecture? (Choose two)

Question 58hardmulti select

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Question 59mediummultiple choice

Open the full BGP breakdown →

You are designing a hybrid architecture where an on-premises Palo Alto Networks PA-5220 firewall connects to an AWS VPC over a Site-to-Site VPN. The on-premises firewall is behind a NAT device that does not preserve source ports. You must ensure that the VPN tunnel establishes and remains stable. Which configuration should you apply on the VM-Series firewall in AWS?

Question 60mediummultiple choice

A NetSec-Architect is designing a hybrid connectivity solution where an on-premises data center must connect to both an AWS Transit Gateway and a Microsoft Azure Virtual WAN. The security team requires that all traffic between on-premises and each cloud be inspected by VM-Series firewalls deployed in the respective cloud, and that the on-premises router only maintain a single BGP peering with each cloud. Which design meets these requirements?

Question 61hardmultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing security for a multi-cloud environment where workloads in AWS and Azure must communicate securely. The design uses VM-Series firewalls in each cloud, and traffic between clouds traverses the public internet. The requirement is to ensure that inter-cloud traffic is encrypted and that the firewalls can inspect the traffic for threats. Which solution should the architect implement?

Question 62mediummultiple choice

Read the full Multi Cloud And Hybrid Network Security Architecture explanation →

An architect is designing a hybrid environment where an on-premises data center connects to an Azure Virtual Network (VNet) using a site-to-site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VNet be inspected by a VM-Series firewall deployed in Azure. The firewall must also inspect traffic between subnets within the VNet. Which Azure VNet configuration is required to meet these requirements?

Question 63hardmultiple choice

An architect is designing a multi-cloud environment where VM-Series firewalls in AWS and Azure must share consistent security policies and object definitions. The requirements include centralized policy management, logging to a single SIEM, and the ability to push policy updates to all firewalls simultaneously. Which solution should the architect implement?

Question 64mediummultiple choice

An architect is connecting an on-premises Palo Alto Networks PA-Series firewall cluster to an AWS VPC using AWS Site-to-Site VPN over the public internet. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the on-premises firewall initiate the IPsec tunnel. The VPC has a virtual private gateway attached. Which configuration should the architect implement on the on-premises firewall to meet these requirements?

Question 65easymultiple choice

An organization is deploying VM-Series firewalls in Google Cloud Platform (GCP) to secure traffic between multiple VPC networks. The architect needs to ensure that the firewalls can inspect traffic between VPCs and that the design supports high availability. Which GCP feature should be used to route traffic through the VM-Series firewalls?

Question 66mediummultiple choice

An architect is designing a multi-cloud network where a Palo Alto Networks VM-Series firewall in AWS must establish an IPsec VPN tunnel to a VM-Series firewall in Google Cloud. Both firewalls are behind NAT devices. The architect needs to ensure that the VPN tunnel can be established despite the NAT. Which configuration should be used on both firewalls?

Question 67easymultiple choice