Select Two (Multi-Select) Questions

Both firewalls must have the same number of active VLANs.

Why wrong: VLAN count does not affect HA formation.

Both firewalls must use the same management interface IP address.

Why wrong: Management IPs must be unique, and will be different.

Both firewalls must have identical license subscriptions.

Why wrong: Licenses can differ; HA synchronization works regardless, but features may not be available if not licensed.

Device groups can only contain firewalls of the same model.

Why wrong: Device groups can contain different models.

Templates override device group settings when both are applied.

Why wrong: Templates and device groups are independent; templates handle network, device groups handle policies.

Panorama cannot manage firewalls in different geographic locations.

Why wrong: Panorama can manage firewalls globally.

CDSS performs full application-level packet inspection.

Why wrong: Packet inspection is done by the firewall, not CDSS.

CDSS is a replacement for the firewall's local threat prevention functionality.

Why wrong: CDSS complements, not replaces, local capabilities.

Traffic to social media websites.

Why wrong: Typically not a compliance concern.

Traffic between internal data center servers.

Why wrong: Internal traffic is often decrypted to detect lateral movement.

Traffic to external email services (e.g., Gmail).

Why wrong: Often decrypted for security.

TLS 1.3 decryption uses the same proxy ciphers as TLS 1.2.

Why wrong: TLS 1.3 uses completely different cipher suites and key exchange mechanisms.

TLS 1.3 decryption requires the firewall to have a hardware security module (HSM).

Why wrong: No HSM is required; decryption is done via software.

TLS 1.3 decryption is only supported for inbound inspection (SSL Inbound Inspection).

Why wrong: TLS 1.3 decryption is supported for both forward proxy and inbound inspection.

The firewall detects that the session is already decrypted (e.g., by another device).

Why wrong: The firewall does not detect if traffic is already decrypted; it will attempt decryption.

The traffic matches a 'no-decrypt' rule in the decryption policy.

Why wrong: That is a policy-based bypass, not a condition; the question asks for conditions.

The decrypted data exceeds a certain size threshold.

Why wrong: Size does not cause bypass; the firewall will still decrypt.

HA3 link configured with a dedicated interface.

Why wrong: HA3 is only used in Active/Active mode.

Heartbeat backup link configured.

Why wrong: Heartbeat backup is optional for redundancy.

Session table synchronization enabled.

Why wrong: Session sync is enabled by default on HA1, but the link itself is the requirement.

Client certificate.

Why wrong: Client certificates are optional; other authentication methods can be used.

DNS suffix.

Why wrong: DNS suffix is optional for client configuration.

The firewall must be in FIPS mode.

Why wrong: FIPS mode is optional and not a prerequisite for User-ID.

The interface must be in a zone.

Why wrong: This is a general network requirement, not specific to User-ID.

An authentication profile must be configured.

Why wrong: Authentication profiles are used for specific authentication methods, but not mandatory for all User-ID setups.

Active/Passive HA with virtual router synchronization

Why wrong: VR synchronization is a mechanism within HA, not a separate redundancy method.

Use of multiple public IPs with NAT rules

Why wrong: Multiple IPs alone do not provide redundancy; routing must also be configured.

Leave the default admin password until the next audit

Why wrong: Default passwords are a security risk; they should be changed immediately after first login.

Use the default NAT policies provided by the initial configuration

Why wrong: Default NAT policies may not fit the branch office's requirements and could be insecure.

Manually download dynamic updates daily to ensure latest signatures

Why wrong: Manual downloads are inefficient; automatic scheduled updates are recommended.

Firewalls must be configured to send User-ID data to the Agent via Server Monitoring.

Why wrong: Server Monitoring is for the firewall to receive user mappings from the Agent, not send.

An Application Override policy must be created for User-ID traffic.

Why wrong: Application override is not needed for User-ID; the traffic is identified via service.

The User-ID Agent must be in the same Layer 2 subnet as the users.

Why wrong: User-ID Agent can be anywhere as long as network connectivity exists.

Insufficient disk space on the log partition.

Why wrong: Disk space affects storage, not CPU directly.

BGP prefix flapping causing route recalculations.

Why wrong: BGP flapping can cause CPU, but it's less common than the others; may be considered plausible but not a top three.

A 'Security Policy' rule with 'Log at Session End' enabled.

Why wrong: While necessary for log generation, it is not specific to email alert configuration.

A 'Panorama' template to push the configuration.

Why wrong: Panorama templates are for centralized management, not required for local email alerts.

A 'User-ID' agent to identify users.

Why wrong: User-ID is not required for email alerts.

show session info

Why wrong: This command shows active sessions but does not directly indicate performance bottlenecks.

show log traffic

Why wrong: This command shows traffic logs, which are for historical analysis, not real-time bottleneck identification.

Enable Multi-Factor Authentication for all admins.

Why wrong: MFA enhances authentication security but does not restrict commit permissions.

Use template stacks to restrict commit permissions.

Why wrong: Template stacks are for managing configuration templates, not commit permissions.

Set the firewall to require approval for commits.

Why wrong: The firewall does not have a native commit approval feature; this would need external workflow.

Stop all logging to reduce CPU load

Why wrong: Logging does not interfere with failover.

Disable preemption on the active firewall

Why wrong: Preemption does not affect readiness.

Check HA1 link utilization

Why wrong: HA1 is not used for session sync.

Increase the packet buffer protection threshold

Why wrong: Packet buffer does not affect sync.

Restart the HA process on both firewalls

Why wrong: Restart is disruptive and not diagnostic.

Software version mismatch between peers

Why wrong: Version mismatch causes 'non-functional' state.

HA2 link failure

Why wrong: HA2 failure does not impact HA state, only session sync.

License mismatch between peers

Why wrong: License mismatch does not cause suspended state.

Both firewalls must have management IPs in different subnets

Why wrong: They must be in the same subnet for HA1 communication.

Both firewalls must have the same interface naming

Why wrong: Interface naming can vary as long as the configuration matches.

Both firewalls must have the same licenses

Why wrong: Licenses can differ; HA does not require identical licenses.