Knowledge + Practice

CCNA Multi Cloud And Hybrid Network Security Architecture Questions

40 questions · Multi Cloud And Hybrid Network Security Architecture · All types, answers revealed

Practice these questions Domain overview All questions

1

Multi-Selecthard

When designing a secure multi-cloud transit architecture with VM-Series firewalls across AWS, Azure, and GCP, which THREE architectural best practices should an architect follow? (Choose three)

Select 3 answers

A.Deploy VM-Series firewalls across multiple Availability Zones / Regions with automated failover or load balancing.

B.Terminate all east-west traffic directly on the public internet without internal cloud firewalls.

C.Use native cloud routing (AWS TGW, Azure UDRs, GCP VPC routes) to steer traffic to the security inspection tier.

D.Centralize security policy orchestration using Panorama across all cloud providers.

E.Rely entirely on native cloud security groups and avoid deploying virtual firewalls for inter-segment inspection.

AnswersA, C, D

Multi-AZ/Region deployments ensure high availability and resilience.

Why this answer

Best practices include centralized management via Panorama, using cloud-native constructs (like TGW, VNets, VPCs) for traffic steering, and deploying firewalls in active/active or scale-out sets across zones.

Practice this question →

2

Multi-Selectmedium

Which TWO actions can be performed using the VM-Series plugin for Panorama? (Choose two)

Select 2 answers

A.Generate physical hardware licenses for legacy PA-5200 series appliances.

B.Directly patch the underlying hypervisor operating system (e.g., VMware ESXi kernel).

C.Provision and manage bootstrapping configurations for VM-Series firewalls in cloud environments.

D.Configure BGP peering sessions on physical customer switches in an on-premises datacenter.

E.Synchronize cloud tags and metadata to populate Dynamic Address Groups on managed firewalls.

AnswersC, E

The plugin facilitates bootstrapping management across clouds.

Why this answer

The VM-Series plugin allows Panorama to trigger bootstrap packages and manage cloud API interactions for dynamic updates.

Practice this question →

3

Multi-Selectmedium

An enterprise architect is designing a hybrid cloud network using VM-Series firewalls deployed in AWS. Which TWO methods can be used to securely bootstrap the VM-Series firewall with Day-0 configuration? (Choose two)

Select 2 answers

A.Direct USB drive attachment to the AWS hypervisor host

B.TFTP push from an on-premises server over an unencrypted public IP

C.AWS S3 bucket containing the standard bootstrap folder structure (config, content, software, license)

D.Automatic Bluetooth pairing with the AWS CLI utility

E.AWS EC2 instance user-data field containing initialization properties

AnswersC, E

AWS S3 is the primary supported mechanism for bootstrapping VM-Series firewalls.

Why this answer

VM-Series on AWS supports bootstrapping via AWS S3 buckets or via the user-data field during instance launch.

Practice this question →

4

MCQeasy

An enterprise is deploying a VM-Series firewall on AWS to secure a VPC. They need to automate the bootstrapping process to inject configuration and software updates upon instance launch. Which S3 bucket structure is required for VM-Series bootstrapping?

A.config, content, license, software

B.bootstrap-data, plugins, updates, keys

C.init-config, firewall-config, lic, sw

D.bootstrap, config, software, licenses

AnswerA

These four directories are strictly required for successful AWS S3 bootstrapping.

Why this answer

The standard AWS bootstrap package structure requires four main folders at the root of the S3 bucket: config, content, license, and software.

Practice this question →

5

Multi-Selecthard

An architect is troubleshooting high packet drop rates on VM-Series firewalls deployed in a high-throughput Azure environment. Which THREE configuration or tuning steps are recommended to optimize performance? (Choose three)

Select 3 answers

A.Configure jumbo frames (MTU 9001) where supported by the cloud virtual network and interfaces.

B.Enable Azure Accelerated Networking on all data plane network interfaces (NICs).

C.Route all management traffic through the same vNIC as the high-throughput data traffic.

D.Disable packet buffer protection globally on all firewalls.

E.Ensure the VM-Series instance size matches Palo Alto Networks verified sizing guidelines (vCPU/RAM).

AnswersA, B, E

Jumbo frames reduce packet overhead and CPU cycles per gigabit transferred.

Why this answer

Optimizing VM-Series performance in Azure involves enabling Accelerated Networking, selecting appropriately sized instance types with sufficient vCPUs/RAM, and tuning session limits/timeouts.

Practice this question →

6

MCQhard

You are configuring AWS Gateway Load Balancer (GWLB) with VM-Series firewalls to inspect inbound and outbound traffic. How does the GWLB encapsulate traffic between the AWS geneva/GENEVE-enabled endpoints and the VM-Series firewalls?

A.GRE tunneling with protocol number 47

B.IPsec VPN tunnels with ESP transport mode

C.VXLAN encapsulation with UDP port 4789

D.GENEVE encapsulation with UDP port 6081

AnswerD

GWLB uses GENEVE encapsulation over UDP port 6081 to wrap packets before sending them to the security appliances.

Why this answer

AWS GWLB uses the GENEVE protocol encapsulation to forward packets transparently to virtual appliances while preserving original packet headers.

Practice this question →

7

Multi-Selectmedium

You are configuring Panorama to manage dynamic address groups (DAGs) populated by cloud tags from Azure workloads. Which THREE components are necessary for this integration to function properly? (Choose three)

Select 3 answers

A.Azure Service Principal (Client ID, Tenant ID, and Secret) with appropriate reader permissions

B.Panorama Cloud Services plugin installed and configured

C.GlobalProtect Clientless VPN portal enabled on all firewall management interfaces

D.Dynamic Address Group object configured in Panorama referencing the cloud tags

E.Physical serial cables connected between Azure datacenters and the Panorama appliance

AnswersA, B, D

Azure API credentials are required for Panorama to query resource tags.

Why this answer

DAG integration with Azure requires the Cloud Services plugin, properly configured Azure API credentials (Service Principal), and matching tag filters in Panorama.

Practice this question →

8

MCQeasy

A security architect needs to license multiple VM-Series firewalls deployed dynamically across an auto-scaling AWS environment. Which licensing model is most appropriate to automate license procurement and revocation upon instance termination?

A.Evaluating trial licenses that expire after 30 days without renewal

B.AuthCodes activated manually via the firewall web interface

C.Perpetual PAK licenses bound to physical MAC addresses

D.VM-Series AuthCode with Panorama AuthCodes / CSS (Cloud-Based Software Licensing)

AnswerD

CSS/AuthCode licensing allows firewalls to automatically request and release licenses from the Palo Alto Networks licensing server upon boot and termination.

Why this answer

VM-Series AuthCodes tied to Panorama or VM-Series AuthCodes with VM-Series Bootstrap using Software-Defined Licensing (AuthCode/VM-Auth) or CSS (Cloud-Based Software Licensing) allows automatic license allocation.

Practice this question →

9

MCQeasy

When sizing a VM-Series firewall for deployment in a public cloud, what are the primary resource metrics an architect must consider to ensure adequate throughput and session capacity?

A.The number of USB ports available on the hypervisor host

B.The physical motherboard BIOS version and GPU core count

C.Hard disk drive RPM speed and RAID controller cache size

D.vCPU count, allocated RAM, and accelerated networking / SR-IOV support

AnswerD

vCPUs, RAM, and accelerated networking capabilities directly dictate VM-Series packet processing and session capacity.

Why this answer

VM-Series performance depends heavily on allocated vCPUs, memory, SR-IOV/DPDK interface support, and instance types.

Practice this question →

10

MCQhard

An architect is designing a multi-cloud network where VM-Series firewalls are deployed in both AWS and Azure. They want to ensure consistent application visibility and threat prevention policies across both clouds. What is the recommended Panorama object structure to achieve this efficiently?

A.Using standalone Expedition migration tools to continuously sync cloud firewalls

B.Separate Panorama instances per cloud provider with entirely unlinked policy rules

C.A single Panorama managing shared Device Groups for security policies and cloud-specific Templates for network settings

D.Local firewall management combined with manual CSV exports of security rules

AnswerC

Shared Device Groups ensure uniform security policies, while cloud-specific templates handle underlying network differences.

Why this answer

Using Device Groups for policy enforcement and Templates for network configuration allows centralized, consistent management across heterogeneous cloud environments.

Practice this question →

11

Multi-Selecthard

When configuring a VM-Series firewall on Google Cloud Platform (GCP), which THREE steps or settings are mandatory for proper operation and traffic inspection? (Choose three)

Select 3 answers

A.Enabling IP Forwarding on all data plane network interfaces (NICs).

B.Installing physical Fiber Channel HBAs into the GCP virtual instance.

C.Attaching appropriate IAM service accounts and access scopes to allow API interactions.

D.Configuring token-ring encapsulation on all trust interfaces.

E.Configuring VPC route tables with next-hop pointing to the VM-Series firewall interface or internal load balancer.

AnswersA, C, E

IP Forwarding is mandatory for GCP instances acting as routers/firewalls.

Why this answer

GCP deployments require enabling IP forwarding on interfaces, configuring custom routes or VPC route tables, and assigning appropriate service accounts or access scopes.

Practice this question →

12

Multi-Selectmedium

Which TWO log types can be forwarded directly from VM-Series firewalls or Panorama to external SIEM or analytics platforms in a multi-cloud architecture? (Choose two)

Select 2 answers

A.Hypervisor BIOS boot logs

B.Local database cache debug dumps

C.Traffic logs

D.Cloud provider IAM audit trail logs

E.Threat logs

AnswersC, E

Traffic logs record session creation, teardown, and bytes transferred.

Why this answer

PAN-OS supports forwarding Traffic, Threat, URL, WildFire, Data, and System logs to external SIEMs via Syslog, HTTPS, or Event Hubs.

Practice this question →

13

MCQmedium

An organization is building a multi-cloud network spanning AWS and GCP. They want to establish a secure, encrypted transit backbone between AWS VPCs and GCP VPCs using Palo Alto Networks VM-Series firewalls as IPsec termination points. Which protocol combination must be configured on the IPsec crypto profile for interoperability between AWS and GCP?

A.IKEv1 with DES encryption and MD5 integrity

B.PPTP with Microsoft Point-to-Point Encryption

C.SSL/TLS version 1.0 with RC4-MD5 ciphers

D.IKEv2 with AES-256-GCM encryption

AnswerD

IKEv2 combined with AES-GCM provides high-performance, secure IPsec tunneling between cloud providers.

Why this answer

Interoperability between AWS Virtual Private Gateways/VM-Series and GCP VPN gateways requires standard IPsec settings, such as IKEv2, AES-GCM or AES-CBC for encryption, and SHA-256 for integrity.

Practice this question →

14

MCQhard

An organization has deployed VM-Series firewalls in Azure and requires all logs to be streamed in real-time to an external SIEM. Which Palo Alto Networks feature or architectural pattern should be used to stream logs directly from the firewalls to Azure Event Hubs?

A.Installing an Azure Log Analytics Agent inside the VM-Series PAN-OS kernel

B.Mounting an Azure Blob Storage container via NFS directly onto the firewall data plane

C.Configuring an Azure Event Hubs Log Forwarding Profile on Panorama / VM-Series

D.Using AWS CloudWatch log groups to capture Azure Event Hub traffic

AnswerC

Log Forwarding Profiles allow direct integration with Azure Event Hubs for real-time SIEM ingestion.

Why this answer

Panorama or VM-Series firewalls support Log Forwarding to external destinations such as syslog, HTTPS, or Azure Event Hubs using Syslog or the Log Forwarding Profile.

Practice this question →

15

MCQmedium

You are configuring Panorama to push template and device group settings to VM-Series firewalls deployed in AWS. A subset of firewalls requires a specific management IP gateway that differs from the default template. How should you handle this exception without creating an entirely new template?

A.Modify the bootstrap init-cfg.txt file directly on running instances via SSH

B.Use Template Variables within the template and define specific variable values per device/serial number

C.Create a separate template stack and assign it to every individual firewall

D.Disable Panorama management on those specific firewalls and manage locally

AnswerB

Template variables allow a single template to apply uniform settings while permitting specific value overrides per firewall.

Why this answer

Panorama templates support Template Variables, allowing administrators to define variables that can be overridden per device or device stack.

Practice this question →

16

Multi-Selectmedium

Which TWO protocols or mechanisms are commonly used for establishing secure site-to-site VPN connectivity between an on-premises datacenter and a public cloud VPC/VNet protected by VM-Series firewalls? (Choose two)

Select 2 answers

A.BGP (Border Gateway Protocol) running over IPsec for dynamic route propagation

B.HTTP unencrypted proxy forwarding for all cloud packets

C.FTP file transfers for packet transmission

D.IPsec VPN tunnels using IKEv2 with pre-shared keys or certificates

E.Telnet remote management sessions across public internet paths

AnswersA, D

BGP over IPsec is widely used to dynamically exchange routing updates between on-prem and cloud.

Why this answer

Site-to-site hybrid connectivity to VM-Series firewalls utilizes IPsec VPN (IKEv2/IKEv1) or cloud-native VPN gateways integrated with the firewalls.

Practice this question →

17

MCQeasy

When deploying VM-Series firewalls in Google Cloud Platform (GCP), which feature must be enabled on the firewall's data plane network interfaces (NICs) to allow the firewall to process packets destined for other IP addresses (such as during routing scenarios)?

A.IP Forwarding

B.VPC Flow Logs

C.Shared VPC attachment

D.Alias IP ranges

AnswerA

IP Forwarding must be enabled on GCP network interfaces so the VM-Series can accept and route packets not explicitly addressed to its own primary IP.

Why this answer

In GCP, instances act as routers only when IP forwarding is explicitly enabled on the network interface configuration.

Practice this question →

18

MCQhard

You are configuring high availability for VM-Series firewalls deployed in AWS across multiple Availability Zones using AWS Lambda for HA failover. What event triggers the AWS Lambda function to initiate the failover sequence?

A.An Amazon SNS email notification clicked by an administrator

B.A direct SNMP trap sent from the firewall management plane to AWS IAM

C.An AWS Trusted Advisor security check failure

D.A CloudWatch metric alarm triggered by path monitoring failure invoking the Lambda function

AnswerD

Path monitoring failure on the VM-Series updates a CloudWatch metric, which triggers the Lambda function to execute failover tasks.

Why this answer

AWS Lambda-based HA for VM-Series relies on the active firewall sending heartbeat or state change messages (or CloudWatch alarms triggered by interface status) to invoke the Lambda function.

Practice this question →

19

MCQeasy

Which cloud provider feature is required when configuring high availability (HA) for VM-Series firewalls in an active/passive deployment to ensure session synchronization and HA heartbeat communication?

A.Dedicated subnets and IP addresses for HA1 (heartbeat) and HA2 (sync) traffic paths

B.Public IP addresses assigned to every management interface

C.Kubernetes persistent volume claims

D.AWS Direct Connect or Azure ExpressRoute dedicated physical circuits

AnswerA

Active/passive HA requires dedicated subnets/IPs for HA1 and HA2 communication between firewall peers.

Why this answer

VM-Series HA in cloud environments requires dedicated internal interfaces/subnets for HA1 (control/heartbeat) and HA2 (data session synchronization).

Practice this question →

20

MCQmedium

You are configuring a VM-Series firewall on AWS to protect an application workload. You want to implement Decryption to inspect inbound SSL/TLS traffic. Where must the SSL server certificate and private key be imported on the VM-Series firewall?

A.Network > Interfaces > SSL Profile

B.Device > Certificate Management > Certificates

C.Objects > Custom Objects > URL Filtering

D.Policies > Decryption > SSH Proxy

AnswerB

Certificates and private keys for inbound decryption must be imported under Device > Certificate Management > Certificates.

Why this answer

Inbound SSL Decryption requires importing the server's private key and certificate into the firewall's Certificate store (Device > Certificate Management > Certificates).

Practice this question →

21

MCQhard

An architect is deploying VM-Series firewalls as an active/passive high-availability pair in Azure across Availability Zones. To facilitate HA failover and ensure traffic re-routing, what Azure networking object must the bootstrap script or HA plugin dynamically update during a failover event?

A.Azure Application Gateway backend pools

B.Azure ExpressRoute direct circuit peering communities

C.Azure Firewall Policy rule collections

D.Azure User Defined Routes (UDR) next-hop IP addresses

AnswerD

The HA script updates the next-hop IP address in the route table to point to the newly active firewall's internal IP.

Why this answer

In Azure, high availability failover relies on updating Azure User Defined Routes (UDRs) or Azure Load Balancer backend pools/IP configurations using the Panorama plugin or Azure API scripts to point to the new active firewall interface.

Practice this question →

22

MCQhard

An organization is implementing a Zero Trust architecture across their hybrid network. Workloads in Azure need to access a database hosted in an on-premises datacenter through a secured IPsec VPN tunnel terminated by VM-Series firewalls. To enforce granular application-layer controls (App-ID) instead of port-based controls, where must the security policy be applied?

A.On the VM-Series firewall security policy rules governing the hybrid VPN zone

B.On the on-premises core switch Spanning Tree Protocol configuration

C.Inside the operating system firewall of the Azure client workload

D.On Azure Network Security Groups (NSGs) applied to the database subnet

AnswerA

The VM-Series security policy evaluates App-ID, User-ID, and Content-ID across the VPN zone.

Why this answer

Security policies using App-ID must be enforced on the VM-Series firewalls inspecting the traffic traversing the hybrid boundary.

Practice this question →

23

MCQmedium

An organization is using Panorama to manage VM-Series firewalls deployed across AWS and Azure. They want to dynamically push security policy updates based on tags assigned to workloads in both clouds. Which Panorama component should be configured to ingest cloud tags?

A.GlobalProtect clientless VPN gateway

B.User-ID Agent

C.Panorama Cloud Services plugin with Cloud Discovery configured

D.Log Collector correlation engine

AnswerC

The Cloud Services plugin allows Panorama to query AWS and Azure APIs and populate dynamic address groups.

Why this answer

Cloud Services plugin enables Panorama to connect to cloud provider APIs, retrieve instance tags, and map them to dynamic address groups.

Practice this question →

24

MCQmedium

You are troubleshooting a VM-Series firewall in AWS where CPU utilization on the dataplane vCPU is at 100%, leading to packet drops. Which PAN-OS CLI command should you run to inspect traffic and process utilization across dataplane cores?

A.debug software restart process mgmtserver

B.show system resources

C.request system factory-reset

D.show session all filter state active

AnswerB

'show system resources' displays CPU and memory utilization for management and dataplane processes.

Why this answer

The command 'show running resource-monitor' or 'show system resources' along with dataplane specific packet buffer commands helps diagnose high CPU on the VM-Series.

Practice this question →

25

MCQeasy

What is the purpose of the VM-Series deployment package 'BYOL' (Bring Your Own License)?

A.It bills the customer hourly directly through the cloud provider's marketplace billing system.

B.It requires the firewall to connect to a physical hardware PA-Series appliance for licensing.

C.It allows administrators to use licenses purchased independently from Palo Alto Networks or channel partners.

D.It restricts the firewall to running evaluation software for a maximum of 14 days.

AnswerC

BYOL enables customers to use pre-purchased authorization codes or CSS subscription credits.

Why this answer

BYOL allows customers to purchase VM-Series software licenses directly from Palo Alto Networks or partners and apply the auth code to the firewall or Panorama.

Practice this question →

26

MCQeasy

Which cloud-native storage mechanism is used by Panorama to store and archive historical log data when deployed in AWS?

A.AWS EBS (Elastic Block Store) mmapped volumes only

B.AWS S3 (Simple Storage Service) via log forwarding and archival

C.AWS EFS (Elastic File System) NFS shares

D.AWS DynamoDB NoSQL tables

AnswerB

AWS S3 is the native object storage service used for archiving Panorama logs in AWS.

Why this answer

Panorama log collectors in public clouds often leverage object storage (e.g., AWS S3) for log forwarding and long-term log archiving.

Practice this question →

27

MCQmedium

You are architecting a Transit Gateway (TGW) design in AWS with centralized security using VM-Series firewalls in a security VPC. East-West traffic between Spoke VPCs must be inspected by the firewalls. Which AWS feature must be configured on the TGW route tables to ensure traffic destined to another Spoke VPC is intercepted and routed to the security VPC attachment?

A.AWS Network Firewall rules mirroring all traffic to the VM-Series interface

B.Security groups attached directly to the TGW attachment interface

C.Route table propagation with specific static routes pointing to the security VPC attachment

D.Cross-region peering attachments with BGP enabled

AnswerC

Static routes pointing to the security VPC attachment are required in the spoke route tables to steer inter-VPC traffic.

Why this answer

AWS Transit Gateway route tables must be configured with specific route associations and propagations, directing traffic from Spoke attachments toward the security VPC attachment for inspection.

Practice this question →

28

MCQeasy

Which hypervisor platforms are officially supported for deploying VM-Series firewalls in a private cloud environment?

A.VMware ESXi, KVM, Nutanix AHV, and Microsoft Hyper-V

B.Apple macOS Hypervisor Framework exclusively

C.Bare-metal x86 servers without any hypervisor layer

D.Oracle VirtualBox and Docker containers only

AnswerA

These are the primary supported enterprise private cloud hypervisors for VM-Series.

Why this answer

VM-Series supports multiple hypervisors including VMware ESXi, KVM, Nutanix AHV, and Microsoft Hyper-V.

Practice this question →

29

MCQmedium

You are deploying VM-Series firewalls in Google Cloud Platform (GCP) using a Shared VPC architecture. Where should the VM-Series firewall instances be deployed to centrally inspect traffic across multiple service projects?

A.In a centralized Host/Security VPC project with shared subnet attachments

B.In an isolated, standalone GCP project with no network peering

C.Directly inside each individual service project without centralized management

D.Inside the Google Kubernetes Engine (GKE) control plane cluster nodes

AnswerA

Deploying firewalls in a centralized host/security project allows management of interfaces across shared subnets.

Why this answer

In a GCP Shared VPC architecture, security appliances are typically deployed in a centralized Host Project (or Security Project), where VPC networks are shared with service projects.

Practice this question →

30

MCQhard

You are configuring Panorama to manage a fleet of VM-Series firewalls in AWS utilizing AWS Secrets Manager to dynamically retrieve API keys and external database credentials. Which Panorama feature enables this integration?

A.Panorama External Services / Secrets Engine integration

B.Log Collector syslog forwarding rules

C.WildFire cloud threat intelligence connector

D.GlobalProtect HIP object mapper

AnswerA

Panorama supports integrating with cloud secrets managers like AWS Secrets Manager to securely fetch credentials.

Why this answer

Panorama external services integration allows retrieval of secrets from AWS Secrets Manager or Azure Key Vault for use in API integrations and User-ID.

Practice this question →

31

MCQhard

An architect is designing an automated deployment pipeline for VM-Series firewalls using Terraform. When creating the initialization configuration for bootstrapping, which file contains the management IP address, gateway, and static routes if DHCP is not used?

A.authcodes.txt

B.init-cfg.txt

C.bootstrap.xml

D.panorama.conf

AnswerB

init-cfg.txt defines basic parameters such as static IP, netmask, default gateway, and Panorama IP addresses.

Why this answer

In VM-Series bootstrap packages, the init-cfg.txt file located in the config directory specifies initial settings like IP address, netmask, default gateway, and Panorama connection details.

Practice this question →

32

Multi-Selecthard

When deploying VM-Series firewalls behind an AWS Gateway Load Balancer (GWLB), which THREE characteristics or requirements are true regarding the architecture? (Choose three)

Select 3 answers

A.GWLB requires BGP peering to be configured directly between the load balancer and the firewalls.

B.VM-Series firewalls can be scaled out horizontally across multiple availability zones behind the GWLB.

C.GWLB uses the GENEVE protocol on UDP port 6081 to encapsulate packets sent to the VM-Series appliances.

D.The VM-Series firewall data interfaces must terminate the GENEVE encapsulated traffic.

E.GWLB alters the source and destination IP addresses of the packets passing through it.

AnswersB, C, D

GWLB supports horizontal auto-scaling of security appliance pools across AZs.

Why this answer

GWLB uses GENEVE encapsulation, inspects traffic transparently at Layer 3 without modifying IP headers, and scales horizontally with target groups.

Practice this question →

33

Multi-Selecthard

An enterprise architect is designing a disaster recovery (DR) strategy for Panorama managing hundreds of VM-Series firewalls across AWS and Azure. Which THREE components are essential for a robust Panorama high availability or backup and recovery design? (Choose three)

Select 3 answers

A.Backing up Panorama VM virtual disks directly to public S3 buckets using unencrypted plain text.

B.Redundant Panorama Log Collectors configured in HA collector groups for log resilience.

C.Maintaining synchronized Template and Device Group hierarchies across primary and secondary management nodes.

D.Relying on manual local text file copies on each individual VM-Series firewall instead of Panorama.

E.Regular scheduled exports of Panorama device state configuration snapshots.

AnswersB, C, E

Log collector groups ensure log data is not lost if a collector fails.

Why this answer

Panorama DR planning involves regular configuration backups, state/log collector replication, and maintaining synchronized template/device group hierarchies.

Practice this question →

34

Multi-Selectmedium

Which TWO deployment patterns are supported for integrating VM-Series firewalls into Microsoft Azure enterprise networks? (Choose two)

Select 2 answers

A.Hub-Spoke VNet architecture with User Defined Routes (UDRs) steering traffic to the hub firewalls

B.Azure Virtual WAN (vWAN) secured virtual hub integration with VM-Series as third-party NVA

C.Replacing the Azure cloud control plane with PAN-OS kernel code

D.Direct physical stacking of VM-Series software onto Azure physical datacenter routers

E.Running VM-Series firewalls as native extensions inside Azure SQL databases

AnswersA, B

Hub-Spoke with UDRs is a standard design pattern for Azure.

Why this answer

VM-Series in Azure can be deployed using Hub-Spoke architectures or Azure Virtual WAN secured virtual hubs.

Practice this question →

35

MCQhard

An architect is troubleshooting asymmetric routing issues in a multi-region AWS deployment where VM-Series firewalls are deployed behind an AWS Gateway Load Balancer. The logs show drops due to 'tcp-non-syn'. What is the root cause and standard remediation?

A.Configuring static ARP entries on the VM-Series data interfaces

B.Disabling TCP SYN validation globally on the Panorama managed firewalls

C.Switching from AWS Gateway Load Balancer to an internal Application Load Balancer

D.Ensuring cross-zone load balancing is enabled on the GWLB target groups so flows return through the same firewall

AnswerD

Cross-zone load balancing and correct GWLB configuration ensure bidirectional traffic hits the same firewall instance.

Why this answer

Asymmetric routing occurs when return traffic bypasses the original firewall instance. With GWLB, flow stickiness is maintained using GENEVE flow hashes, but misconfigured routing tables or multiple AZ crossings can cause asymmetry.

Practice this question →

36

Multi-Selecthard

An architect is troubleshooting a high availability (HA) split-brain scenario in an active/passive VM-Series deployment in a public cloud. Which THREE factors or misconfigurations typically cause split-brain conditions in cloud HA environments? (Choose three)

Select 3 answers

A.Running different PAN-OS minor patch versions on the HA pair for an extended period.

B.Misconfigured path monitoring that fails to detect upstream routing failures.

C.Using identical MAC addresses on all data plane interfaces without cloud hypervisor support.

D.Excessive packet loss or high latency on the dedicated HA heartbeat network path.

E.Network Security Groups or firewall rules blocking UDP/TCP ports used for HA1 and HA2 communication.

AnswersB, D, E

Improper path monitoring prevents the active unit from stepping down when isolated.

Why this answer

Split-brain in cloud HA can be caused by blocking HA communication ports in security groups, intermittent packet loss on HA1/HA2 links, or misconfigured path monitoring failing to trigger state changes.

Practice this question →

37

MCQmedium

You are designing a hybrid cloud architecture where an on-premises datacenter connects to an Azure Virtual Network (VNet) via ExpressRoute. To ensure all inter-VNet and hybrid traffic passes through a pair of VM-Series firewalls deployed in a hub VNet, what Azure feature must you configure on the hub VNet gateway subnet?

A.ExpressRoute FastPath configuration

B.User Defined Route (UDR) table associated with the GatewaySubnet

C.Virtual Network peering remote gateways setting

D.Azure Firewall Manager Route Propagation

AnswerB

Associating a UDR with the GatewaySubnet forces gateway traffic to route to the VM-Series security appliance.

Why this answer

To steer traffic from an ExpressRoute or VPN gateway through a hub-spoke security architecture, a User Defined Route (UDR) must be associated with the GatewaySubnet pointing to the firewall's internal load balancer or interface.

Practice this question →

38

MCQeasy

When deploying a VM-Series firewall on Microsoft Azure, how many network interfaces (NICs) are minimally required to implement a standard 3-subnet architecture (Management, Trust, Untrust)?

A.2 NICs

B.1 NIC

C.3 NICs

D.4 NICs

AnswerC

3 NICs allow dedicated interfaces for management, untrust, and trust subnets.

Why this answer

A typical production deployment of a VM-Series firewall in Azure requires at least 3 NICs: management, untrust (external), and trust (internal).

Practice this question →

39

MCQmedium

An enterprise deploys VM-Series firewalls in an Azure Hub-Spoke topology. Spoke VNets must communicate with each other exclusively through the hub VM-Series firewalls. What Azure construct prevents spoke VNets from bypassing the firewall by communicating directly via VNet peering?

A.Enabling Azure DDoS Protection Standard on all spoke subnets

B.Disabling 'Allow Forwarded Traffic' on the VNet peering settings and enforcing UDRs in spoke subnets

C.Deploying Azure Bastion hosts in each spoke VNet

D.Configuring Azure ExpressRoute Global Reach between all spokes

AnswerB

To force traffic through the hub firewall, spoke subnets must use UDRs pointing to the firewall, and peering must be carefully structured.

Why this answer

By default, Azure VNet peering allows direct traffic between peered VNets unless peerings are configured without gateway transit, or UDRs/Network Security Groups (NSGs) are used to block direct traffic, or peering routes are overridden.

Practice this question →

40

MCQeasy

What is the primary function of the VM-Series plugin for Panorama?

A.To compile WildFire malware signatures locally on the firewall data plane

B.To accelerate IPsec VPN tunnel throughput using hardware encryption crypto chips

C.To provide zero-touch provisioning and cloud API integration for VM-Series firewalls across multi-cloud environments

D.To replace the need for Panorama Log Collectors in distributed deployments

AnswerC

The VM-Series plugin allows Panorama to interact with cloud APIs, handle bootstrapping, and manage cloud-specific features.

Why this answer

The VM-Series plugin for Panorama enables Panorama to manage VM-Series firewalls across various public and private cloud environments and interact with cloud APIs.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Multi Cloud And Hybrid Network Security Architecture questions.

Start 20-question session