6.4 Configuring Self-Managed Network Virtual Appliance and Packet Mirroring. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are designing a highly available NGFW deployment using a pair of multi-NIC VMs. You want to use an internal load balancer as the next hop for routes in the peered VPCs. The NGFW VMs are in a management VPC. What must you configure on the internal load balancer to ensure it forwards traffic to the NGFW VMs correctly?

   • AA network load balancer with the NGFW VMs as backends and a firewall rule to allow traffic from the load balancer.
   • BA forwarding rule with the NGFW VMs' IP addresses as the backend.
   • CA backend service with the NGFW VMs as backends and a health check on the NGFW's management port.
   • DA TCP proxy load balancer with the NGFW VMs as backends.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When configuring an internal load balancer as the next hop for HA multi-NIC VM routing, what must be specified as the next hop in the custom route?

   • AThe IP address of the VPC peering gateway
   • BThe external IP address of the load balancer
   • CThe internal IP address of the load balancer's forwarding rule
   • DThe IP address of the primary NGFW VM
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   Your company is deploying a new security inspection solution that must not introduce a single point of failure or add latency to production traffic. You plan to use a third-party NGFW that is currently deployed in a separate VPC. You need to integrate the NGFW so that it can inspect traffic without being inline. Which approach should you use?

   • AConfigure Packet Mirroring to copy traffic from the production VPC to the NGFW VPC for analysis.
   • BDeploy the NGFW as a gateway appliance in the production VPC and configure policy-based routes.
   • CUse a dedicated interconnect to connect the NGFW VPC to the production VPC.
   • DCreate a VPC peering connection between the production VPC and the NGFW VPC and add routes to send traffic through the NGFW.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A network engineer wants to route traffic between two VPC networks through a multi-NIC NGFW VM for inspection. Which routing mechanism is used to direct traffic from a subnet to the NGFW VM's internal IP address?

   • AA default route with the internet gateway as the next hop
   • BA VPC peering connection with the NGFW VM as the next hop
   • CA custom static route with the NGFW VM's internal IP as the next hop
   • DA firewall rule that redirects traffic to the NGFW VM
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A network engineer needs to send only traffic from a specific source subnet to an HA pair of NGFW VMs, while other traffic uses the default route. Which routing feature should be used?

   • AA VPC peering connection
   • BA firewall rule with a higher priority
   • CA static route with a lower priority
   • DPolicy-based routes
   Reveal Solution Discussion Select an answer first