A security team is planning to deploy Broker VM in a private VPC without internet access. They need to forward DNS traffic to Palo Alto Networks DNS Security. What is the required configuration to enable this?

Place the Broker VM in a public subnet and use a NAT gateway for outbound traffic.

Use a VPC endpoint or private connection to allow the Broker VM to reach the DNS Security cloud service.

Configure the DNS server to send queries directly to the DNS Security service.

Deploy the Broker VM with a public IP and configure the DNS Security service to use that IP.

In which deployment scenario is Broker VM most commonly used?

In a branch office to provide local internet access

In a cloud environment to enable traffic inspection by cloud-delivered security services

On a user's endpoint to provide local security

In a data center to replace existing firewalls

A network administrator is configuring Broker VM to forward traffic to Palo Alto Networks IoT Security. The Broker VM has two network interfaces: eth0 for management and eth1 for data. Which configuration is required to ensure IoT traffic is forwarded correctly?

Create a VPC peering connection between the Broker VM and the IoT Security service.

Assign a public IP to eth1 and configure the IoT Security service to use that IP.

Set eth0 as the dataplane interface and eth1 as the management interface.

Configure eth1 as the dataplane interface and enable the IoT Security integration in the Broker VM settings.

A large enterprise is deploying Broker VM in a multi-cloud environment (AWS and Azure) to inspect DNS traffic. They have strict security requirements: no internet access for the Broker VM, and all traffic must stay within the cloud provider's private network. They also need to forward traffic to Palo Alto Networks DNS Security. What is the best approach to meet these requirements?

Deploy a separate Broker VM in each cloud and use private connectivity (e.g., VPC endpoints or PrivateLink) to reach DNS Security.

Use the cloud provider's native DNS service and forward logs to DNS Security via API.

Deploy Broker VM in a single cloud and use a public IP for outbound communication to DNS Security.

Deploy a single Broker VM in AWS and route all DNS traffic from Azure to it via a site-to-site VPN.

How does traffic return to the network after being inspected by Broker VM?

It is sent to a different subnet for routing

It is sent back through the same interface it entered

It is encapsulated in a VPN tunnel

Palo Alto NetworksCertified Cloud Security Engineer

Domain 2Objective 6

2.6 Explain the Deployment and Configuration Process for Broker VM CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Integration domain, which accounts for 16% of the CLOUD-SECURITY-ENGINEER exam.

25questions here

5free pages

7concepts

16%of the exam

Questions 11–15

11application · medium
A security team is planning to deploy Broker VM in a private VPC without internet access. They need to forward DNS traffic to Palo Alto Networks DNS Security. What is the required configuration to enable this?
Select an answer first
12foundation · easy
In which deployment scenario is Broker VM most commonly used?
Select an answer first
13application · medium
A network administrator is configuring Broker VM to forward traffic to Palo Alto Networks IoT Security. The Broker VM has two network interfaces: eth0 for management and eth1 for data. Which configuration is required to ensure IoT traffic is forwarded correctly?
Select an answer first
14expert · hard
A large enterprise is deploying Broker VM in a multi-cloud environment (AWS and Azure) to inspect DNS traffic. They have strict security requirements: no internet access for the Broker VM, and all traffic must stay within the cloud provider's private network. They also need to forward traffic to Palo Alto Networks DNS Security. What is the best approach to meet these requirements?
Select an answer first
15foundation · easy
How does traffic return to the network after being inspected by Broker VM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.