NetSec-Architect Multi Cloud And Hybrid Network Security Architecture Practice Test 2 — 15 Questions

Question 1

An organization is deploying VM-Series firewalls in Microsoft Azure to secure traffic between multiple virtual networks (VNets) in a hub-and-spoke topology. The security team wants to ensure that all inter-spoke traffic is inspected by the firewall without requiring complex user-defined routes (UDRs) in each spoke VNet. Which Azure feature should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Route Server. Azure Route Server integrates with network virtual appliances (NVAs) like VM-Series to exchange routes dynamically. When the firewall peers with Route Server, it can advertise routes for the spoke VNets, and Route Server injects these into the VNets' effective routes. This eliminates the need for manual UDRs in each spoke, as the routes are propagated automatically. This design simplifies operations and ensures all inter-spoke traffic is inspected by the firewall.

Answer

Azure Firewall Manager

Answer

Azure Virtual Network Peering with gateway transit

Answer

Azure Private Link

Question 2

A network security architect is designing a multi-cloud environment with VM-Series firewalls in AWS and Azure. They need to ensure that security policies are consistently applied across both clouds. Which Palo Alto Networks solution should they use to centrally manage policies and configurations for all VM-Series firewalls?

Accepted Answer

Panorama in panorama mode. Panorama in panorama mode is the centralized management solution for Palo Alto Networks firewalls, including VM-Series. It enables consistent policy and configuration across multiple firewalls in different clouds. Other options are either not real modes or serve different purposes, such as cloud security posture or SASE.

Answer

Panorama in management mode

Answer

Prisma Access

Answer

Cloud Native Application Protection Platform (CNAPP)

Question 3

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. The architect wants to centralize policy management and logging across both clouds. Which solution should be used?

Accepted Answer

Deploy Panorama in a cloud-neutral location with private connectivity to both AWS and Azure, such as using AWS Transit Gateway and Azure ExpressRoute, and configure all VM-Series firewalls to connect to it.. Centralized management and logging across AWS and Azure require Panorama to have private, reliable connectivity to all VM-Series firewalls. Deploying Panorama in a cloud-neutral location with private connections such as AWS Transit Gateway and Azure ExpressRoute ensures secure communication and consistent policy enforcement. This design avoids exposing management interfaces to the public internet and supports scalability.

Answer

Deploy Panorama in one cloud and use a site-to-site VPN to connect the other cloud's firewalls for management and logging.

Answer

Deploy Panorama on-premises and configure each VM-Series firewall to connect to it for policy and logging.

Answer

Deploy Panorama in AWS and configure Azure VM-Series firewalls to connect to it over the public internet.

Question 4

An architect is troubleshooting asymmetric routing in a hybrid cloud environment where VM-Series firewalls in AWS inspect traffic between an on-premises data center and a VPC. The traffic enters the firewall from the VPN attachment via a transit gateway, but return traffic from the VPC is bypassing the firewall. Which configuration change is most likely to resolve this issue?

Accepted Answer

Enable appliance mode on the transit gateway attachment for the firewall VPC.. In AWS transit gateway deployments, appliance mode must be enabled on the attachment for the VPC that hosts the VM-Series firewall. Appliance mode ensures that traffic flows are symmetric by using the sameAvailability Zone and firewall instance for both directions. Without it, return traffic may be routed to a different firewall instance or bypass the firewall entirely, leading to asymmetric routing and potential session drops. Enabling appliance mode is the correct solution.

Answer

Disable source/destination check on the firewall's ENI.

Answer

Configure policy-based routing on the VM-Series firewall to force return traffic through the same interface.

Answer

Add a route in the VPC route table pointing to the firewall's ENI for the on-premises CIDR.

Question 5

You are designing a hybrid network where an on-premises datacenter connects to an Azure VNet via ExpressRoute. You need to ensure that traffic between on-premises and Azure is inspected by a VM-Series firewall deployed in Azure. What is the correct way to route traffic through the firewall?

Accepted Answer

Create a UDR on the workload subnets that points to the VM-Series firewall's untrusted interface as the next hop for on-premises destinations.. To route traffic from Azure workloads to on-premises through a VM-Series firewall, you must create a user-defined route on the workload subnets that directs traffic destined for on-premises to the firewall's interface as the next hop. This forces inspection. UDRs on the GatewaySubnet are not recommended and can disrupt the gateway.

Answer

Create a user-defined route (UDR) on the GatewaySubnet that points to the VM-Series firewall's trusted interface as the next hop.

Answer

Configure VNet peering between the workload VNet and the GatewaySubnet VNet, and enable traffic forwarding on the firewall's NIC.

Answer

Enable Azure Route Server and configure BGP peering between the VM-Series firewall and the ExpressRoute gateway to advertise routes.

Question 6

An architect is deploying VM-Series firewalls in Google Cloud Platform (GCP) to inspect traffic between multiple VPC networks. The architect plans to use a hub-and-spoke topology with a central inspection VPC. Which TWO GCP features or configurations are required to ensure that traffic between spoke VPCs is inspected by the firewall? (Choose two.)

Accepted Answer

Use Network Connectivity Center (NCC) to create a hub-and-spoke topology where the inspection VPC is the hub, and spoke VPCs are attached to the hub.. To inspect traffic between spoke VPCs in GCP, Network Connectivity Center (NCC) is used to create a hub-and-spoke topology, enabling transitive routing through the inspection VPC. An internal load balancer (ILB) in the inspection VPC distributes traffic to VM-Series firewalls, and NCC routes traffic to the ILB. This ensures all inter-VPC traffic is inspected. VPC peering and Cloud Router do not provide the necessary transitive routing or next-hop capabilities.

Answer

Cloud Router with custom route advertisements to propagate routes from the inspection VPC to spoke VPCs.

Answer

Configure a global external HTTP(S) load balancer to distribute traffic to the VM-Series firewalls.

Answer

VPC Network Peering between the inspection VPC and each spoke VPC, with custom routes to direct traffic to the firewall's internal load balancer.

Question 7

A security architect is designing a hybrid network where an on-premises data center connects to an AWS VPC using AWS Site-to-Site VPN. The architect wants to inspect all traffic between the on-premises network and the VPC using VM-Series firewalls deployed in AWS. The firewalls are deployed in a single subnet with one ENI for management and one ENI for data. Which AWS VPC route table configuration is required to ensure that traffic from the VPN gateway is inspected by the firewall?

Accepted Answer

Add a route in the route table associated with the VPN gateway's subnet that directs traffic destined for the on-premises network to the firewall's data ENI.. To ensure VPN traffic is inspected, the route table associated with the subnet containing the VPN gateway's ENIs must have a route that directs traffic destined for the on-premises network to the firewall's data ENI. This forces traffic from the VPN gateway to the firewall for inspection before it reaches other subnets. The firewall then forwards traffic to the on-premises network via the VPN gateway, using its own route table to send traffic back to the gateway.

Answer

Add a route in the VPC's main route table that directs traffic destined for the on-premises network to the firewall's data ENI.

Answer

Configure the VPN gateway to use the firewall as the virtual private gateway for the VPN connection.

Answer

Add a route in the route table associated with the firewall's subnet that directs traffic destined for the on-premises network to the VPN gateway.

Question 8

You manage a hybrid network where an on-premises datacenter connects to Google Cloud via Cloud VPN. You have VM-Series firewalls in a GCP VPC performing inspection for workloads in multiple subnets. You need to ensure that traffic from on-premises to any workload subnet is inspected, and that return traffic follows the same path. Which combination of GCP components should you use?

Accepted Answer

Create a custom static route in the VPC that sends on-premises traffic to the VM-Series, and add a route in the firewall's subnet that points to the Cloud VPN tunnel as the next hop for return traffic.. In GCP, to force traffic through a VM-Series, you need a custom static route in the VPC that directs on-premises traffic to the firewall's internal IP. For return traffic, the firewall's subnet must have a route that sends traffic destined to on-premises back to the Cloud VPN tunnel. This symmetrical routing ensures the firewall sees both directions of the flow, which is essential for stateful inspection.

Answer

Deploy the VM-Series in a separate VPC and use VPC Network Peering with 'Import custom routes' enabled to force traffic through the firewall.

Answer

Configure policy-based routes (PBR) in the workload subnets to redirect traffic to the VM-Series, and enable 'Global routing mode' on the VPC.

Answer

Use a custom static route in the VPC with the VM-Series as the next hop for the on-premises destination, and configure the firewall to SNAT return traffic.

Question 9

You are designing a multi-cloud architecture where AWS workloads must securely access Azure services over the public internet. You want to use VM-Series firewalls in both clouds to inspect traffic and enforce security policies. Which AWS feature should you use to route traffic from an AWS VPC to the VM-Series for inspection before it goes to Azure?

Accepted Answer

AWS Transit Gateway with a VPC attachment and a route table that directs traffic to the VM-Series ENI.. AWS Transit Gateway acts as a hub to route traffic between VPCs and can direct traffic to a VM-Series ENI via a route table entry. By associating the appropriate route table with the VPC attachment, you can ensure that traffic destined to Azure is sent to the firewall for inspection before leaving the VPC.

Answer

AWS Gateway Load Balancer with a VPC endpoint service and a route table entry pointing to the Gateway Load Balancer endpoint.

Answer

AWS Direct Connect gateway with a virtual interface to the VM-Series.

Answer

AWS Network Firewall with a stateless rule group that forwards traffic to the VM-Series.

Question 10

You are deploying VM-Series firewalls in a multi-cloud environment consisting of AWS and Azure. You need to ensure that the firewalls can inspect traffic between the two clouds and that management traffic is separated from data traffic. Which TWO design considerations are required to achieve this? (Choose two.)

Accepted Answer

Use separate VPCs/VNets for management and data interfaces, and configure security groups/NSGs to allow only management traffic on the management interface.. To achieve inspection between AWS and Azure with separated management and data traffic, you should deploy VM-Series in a hub VPC/VNet and use transit gateways or virtual network gateways for routing. Additionally, using separate VPCs/VNets for management and data interfaces with appropriate security group/NSG rules ensures that management traffic is isolated from data traffic.

Answer

Ensure that the data plane interfaces have public IP addresses to allow cross-cloud traffic over the internet.

Answer

Configure the VM-Series to use a single network interface for both management and data traffic to simplify routing.

Answer

Use the same IP address for management and data interfaces to reduce complexity.

Question 11

A security architect is deploying VM-Series firewalls in a multi-cloud environment spanning AWS and Azure. The architect needs to ensure that traffic between the two clouds is inspected by the firewalls and that the solution supports active/active high availability across clouds. Which design consideration is most critical for achieving cross-cloud active/active HA?

Accepted Answer

Establishing a dedicated, low-latency HA transport network between the AWS and Azure firewalls. For active/active HA across clouds, the firewalls must exchange heartbeats and synchronize sessions over a dedicated, low-latency network. This HA transport is separate from the data traffic and must be highly available. Without it, the HA cluster cannot function reliably, making it the most critical design consideration.

Answer

Configuring identical PAN-OS versions and licenses on all VM-Series firewalls in both clouds

Answer

Deploying all VM-Series firewalls in a single cloud and using inter-cloud routing to hairpin traffic

Answer

Using AWS Transit Gateway and Azure Virtual WAN to route traffic between the clouds

Question 12

An architect is designing a hybrid cloud network where an on-premises data center connects to both AWS and Azure using IPSec VPNs. The architect wants to ensure that if the primary VPN tunnel to AWS fails, traffic automatically fails over to a secondary tunnel to Azure, and vice versa. Which Palo Alto Networks feature should be used to achieve this dynamic path selection?

Accepted Answer

Dynamic Routing with BGP and route-based VPNs. BGP with route-based VPNs is the standard for dynamic routing in AWS and Azure. It allows the firewall to exchange routes with cloud gateways and automatically redirect traffic if a tunnel fails. This provides the required dynamic path selection and failover between AWS and Azure.

Answer

Static routes with path monitoring using ICMP probes

Answer

Dynamic Routing with OSPF and BFD

Answer

Policy-Based Forwarding (PBF) with static routes

Question 13

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

Accepted Answer

IP Forwarding. In GCP, when deploying VM-Series firewalls, the data plane network interfaces (NICs) must have IP Forwarding enabled to allow the firewall to process packets destined for other IP addresses. This is because the firewall acts as a router or gateway, forwarding traffic between subnets or to the internet, and GCP by default disables IP forwarding on NICs to prevent unintended routing. Enabling IP forwarding allows the VM to send and receive packets not addressed to its own IP.

Answer

VPC Flow Logs

Answer

Shared VPC attachment

Answer

Alias IP ranges

Question 14

An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?

Accepted Answer

config, content, license, software. The standard AWS bootstrap package structure requires four main folders at the root of the S3 bucket: config, content, license, and software.

Answer

bootstrap-data, plugins, updates, keys

Answer

init-config, firewall-config, lic, sw

Answer

bootstrap, config, software, licenses

Question 15

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

Accepted Answer

Azure User Defined Routes (UDR) next-hop IP addresses. In an active/passive HA setup for VM-Series firewalls in Azure across Availability Zones, the HA failover process requires updating Azure User Defined Routes (UDR) to point to the new active firewall's IP address as the next hop. This ensures that traffic is re-routed to the newly active firewall after a failover, maintaining network connectivity. The bootstrap script or HA plugin dynamically updates the UDR next-hop IP addresses during failover.

Answer

Azure Application Gateway backend pools

Answer

Azure ExpressRoute direct circuit peering communities

Answer

Azure Firewall Policy rule collections