NetSec-Architect Multi Cloud And Hybrid Network Security Architecture Practice Test 3 — 15 Questions

Question 1

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GENEVE encapsulation with UDP port 6081. AWS GWLB uses the GENEVE protocol encapsulation to forward packets transparently to virtual appliances while preserving original packet headers.

Answer

GRE tunneling with protocol number 47

Answer

IPsec VPN tunnels with ESP transport mode

Answer

VXLAN encapsulation with UDP port 4789

Question 2

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

Accepted Answer

User Defined Route (UDR) table associated with the GatewaySubnet. To steer traffic from an ExpressRoute or VPN gateway through a hub-spoke security architecture, a User Defined Route (UDR) must be associated with the GatewaySubnet pointing to the firewall's internal load balancer or interface.

Answer

ExpressRoute FastPath configuration

Answer

Virtual Network peering remote gateways setting

Answer

Azure Firewall Manager Route Propagation

Question 3

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

Accepted Answer

Panorama Cloud Services plugin with Cloud Discovery configured. Cloud Services plugin enables Panorama to connect to cloud provider APIs, retrieve instance tags, and map them to dynamic address groups.

Answer

GlobalProtect clientless VPN gateway

Answer

User-ID Agent

Answer

Log Collector correlation engine

Question 4

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

Accepted Answer

IKEv2 with AES-256-GCM encryption. Interoperability between AWS Virtual Private Gateways/VM-Series and GCP VPN gateways requires standard IPsec settings, such as IKEv2, AES-GCM or AES-CBC for encryption, and SHA-256 for integrity.

Answer

IKEv1 with DES encryption and MD5 integrity

Answer

PPTP with Microsoft Point-to-Point Encryption

Answer

SSL/TLS version 1.0 with RC4-MD5 ciphers

Question 5

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

Accepted Answer

3 NICs. A typical production deployment of a VM-Series firewall in Azure requires at least 3 NICs: management, untrust (external), and trust (internal).

Answer

2 NICs

Answer

1 NIC

Answer

4 NICs

Question 6

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

Accepted Answer

AWS S3 (Simple Storage Service) via log forwarding and archival. Panorama in AWS uses AWS S3 as the cloud-native storage mechanism for historical log data. Logs collected from managed firewalls are forwarded to Panorama, and Panorama can archive them to S3 buckets for long-term retention and retrieval. S3 provides durable, scalable object storage that integrates natively with Panorama's log forwarding and archival features.

Answer

AWS EBS (Elastic Block Store) mmapped volumes only

Answer

AWS EFS (Elastic File System) NFS shares

Answer

AWS DynamoDB NoSQL tables

Question 7

What is the primary function of the VM-Series plugin for Panorama?

Accepted Answer

To provide zero-touch provisioning and cloud API integration for VM-Series firewalls across multi-cloud environments. The VM-Series plugin for Panorama extends Panorama's management capabilities specifically for virtualized firewalls. It enables zero-touch provisioning (ZTP) by allowing Panorama to bootstrap VM-Series instances in AWS, Azure, and GCP, and it integrates with cloud provider APIs to dynamically discover and onboard new firewall instances. This plugin is what makes Panorama a viable centralized manager for elastic, multi-cloud VM-Series deployments.

Answer

To compile WildFire malware signatures locally on the firewall data plane

Answer

To accelerate IPsec VPN tunnel throughput using hardware encryption crypto chips

Answer

To replace the need for Panorama Log Collectors in distributed deployments

Question 8

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

Accepted Answer

In a centralized Host/Security VPC project with shared subnet attachments. In a GCP Shared VPC architecture, security appliances are typically deployed in a centralized Host Project (or Security Project), where VPC networks are shared with service projects.

Answer

In an isolated, standalone GCP project with no network peering

Answer

Directly inside each individual service project without centralized management

Answer

Inside the Google Kubernetes Engine (GKE) control plane cluster nodes

Question 9

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

Accepted Answer

init-cfg.txt. In VM-Series bootstrap packages, the init-cfg.txt file located in the config directory specifies initial settings like IP address, netmask, default gateway, and Panorama connection details.

Answer

authcodes.txt

Answer

bootstrap.xml

Answer

panorama.conf

Question 10

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

Accepted Answer

vCPU count, allocated RAM, and accelerated networking / SR-IOV support. In public cloud environments, VM-Series firewall performance is primarily determined by the allocated vCPU count, RAM, and whether accelerated networking (e.g., SR-IOV) is enabled. vCPUs drive the data plane and management plane processing, RAM affects session table size and buffering, and accelerated networking bypasses the hypervisor virtual switch to deliver near line-rate throughput and lower latency. These metrics directly map to the throughput and session capacity specifications published by Palo Alto Networks for each VM-Series model.

Answer

The number of USB ports available on the hypervisor host

Answer

The physical motherboard BIOS version and GPU core count

Answer

Hard disk drive RPM speed and RAID controller cache size

Question 11

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

Accepted Answer

Device > Certificate Management > Certificates. Inbound SSL Decryption requires importing the server's private key and certificate into the firewall's Certificate store (Device > Certificate Management > Certificates).

Answer

Network > Interfaces > SSL Profile

Answer

Objects > Custom Objects > URL Filtering

Answer

Policies > Decryption > SSH Proxy

Question 12

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

Accepted Answer

VMware ESXi, KVM, Nutanix AHV, and Microsoft Hyper-V. VM-Series supports multiple hypervisors including VMware ESXi, KVM, Nutanix AHV, and Microsoft Hyper-V.

Answer

Apple macOS Hypervisor Framework exclusively

Answer

Bare-metal x86 servers without any hypervisor layer

Answer

Oracle VirtualBox and Docker containers only

Question 13

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

Accepted Answer

A single Panorama managing shared Device Groups for security policies and cloud-specific Templates for network settings. A single Panorama instance managing shared Device Groups for security policy and cloud-specific Templates for network settings is the recommended design because Device Groups hold policy objects (rules, profiles, objects) that should be identical across clouds, while Templates hold device/network configuration (interfaces, zones, virtual routers) that must differ per cloud platform. This separation lets the architect write threat prevention and App-ID policy once and push it everywhere, while still accommodating AWS VPC and Azure VNet networking differences. It also avoids policy drift and duplicated rule maintenance.

Answer

Using standalone Expedition migration tools to continuously sync cloud firewalls

Answer

Separate Panorama instances per cloud provider with entirely unlinked policy rules

Answer

Local firewall management combined with manual CSV exports of security rules

Question 14

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

Accepted Answer

It allows administrators to use licenses purchased independently from Palo Alto Networks or channel partners.. The BYOL (Bring Your Own License) deployment package for VM-Series allows organizations to apply existing perpetual or term-based licenses that were purchased separately through Palo Alto Networks or authorized channel partners, rather than acquiring licensing through the cloud marketplace. This model is ideal for enterprises that already have license entitlements and want to deploy firewalls in AWS, Azure, or GCP without paying hourly marketplace rates. The license is tied to the VM-Series instance via a license activation process, enabling full feature set including advanced security subscriptions if separately licensed.

Answer

It bills the customer hourly directly through the cloud provider's marketplace billing system.

Answer

It requires the firewall to connect to a physical hardware PA-Series appliance for licensing.

Answer

It restricts the firewall to running evaluation software for a maximum of 14 days.

Question 15

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

Accepted Answer

show system resources. The 'show system resources' command displays CPU utilization per dataplane core, memory, and load averages, making it the correct tool to inspect dataplane vCPU saturation and identify packet-drop causes. It is the standard PAN-OS CLI command for resource troubleshooting on VM-Series. The other options either restart services, reset the system, or list sessions without showing CPU per core.

Answer

debug software restart process mgmtserver

Answer

request system factory-reset

Answer

show session all filter state active