10.4 Architect HA Deployment for Private Cloud Resilience NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise is designing a private cloud with two data centers. The architect must provide firewall HA across both data centers for a mission-critical application. The application uses TCP for database replication and UDP for real-time analytics. The architect is considering using a pair of PA-5250 firewalls in active/passive HA with state synchronization. The network latency between the data centers is 50 ms. What is the primary concern the architect must address?

   • AActive/passive HA is not supported across data centers.
   • BThe architect must use active/active HA to meet the failover requirement.
   • CState synchronization over a 50 ms WAN link may not meet the failover time requirement for the application.
   • DPA-5250 firewalls do not support state synchronization over WAN links.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a key HA limitation of 4th generation Palo Alto Networks hardware firewalls compared to 5th generation models?

   • AThey do not support active/active HA at all.
   • BThey have lower session synchronization throughput, which can impact failover performance under heavy load.
   • CThey require a dedicated HA link that is not available on 5th generation models.
   • DThey cannot be clustered in an HA pair.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In an active/passive HA pair of Palo Alto Networks firewalls, what is the primary role of the passive (secondary) firewall during normal operation?

   • AIt only handles management traffic and does not participate in failover.
   • BIt actively monitors the network and updates routing tables independently.
   • CIt processes a portion of the traffic to offload the active firewall.
   • DIt remains ready to take over if the active firewall fails, while not forwarding traffic.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare provider runs a pair of PA-3260 firewalls in active/passive HA. The network carries HL7 messages over TCP and real-time medical device telemetry over UDP. The architect needs to ensure that a failover does not interrupt patient monitoring. The current failover takes 10 seconds, which is too long. What is the most effective way to reduce failover time for both TCP and UDP traffic?

   • AUse active/active HA mode to distribute traffic across both firewalls.
   • BConfigure the passive firewall to use a higher priority than the active firewall.
   • CEnable session setup, pre-allocate session resources on the passive firewall, and ensure state synchronization is configured for both TCP and UDP.
   • DReduce the HA hello timer to 1 second and the failover timer to 3 seconds.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A large cloud provider is designing a multi-tenant environment where each tenant requires firewall inspection with the ability to scale horizontally to handle millions of sessions. The architect needs a solution that provides a single logical firewall cluster across many physical nodes, with centralized management and automatic failover. Which approach best meets these requirements?

   • APlace a single high-end PA-7000 series firewall in each tenant's network segment.
   • BDeploy a Hyperscale Security Fabric (HSF) with multiple VM-Series firewalls managed as a single cluster.
   • CUse a traditional active/passive HA pair of PA-5200 series firewalls with state synchronization.
   • DConfigure multiple independent VM-Series firewalls with a load balancer in front of them.
   Reveal Solution Discussion Select an answer first