10.4 Architect HA Deployment for Private Cloud Resilience NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm runs a VM-Series pair in active/passive HA on VMware vSphere to protect a critical trading application. The compliance team requires that if the active firewall fails, the new active firewall must be processing traffic within 3 seconds. The network team notes that the trading application uses long-lived TCP connections with a 5-minute idle timeout, and the security team wants to avoid forcing users to re-authenticate on failover. Which configuration should the architect prioritize to meet the failover requirement?

   • APlace both firewalls on the same ESXi host and enable link-speed HA to minimize packet propagation delay.
   • BConfigure the passive firewall with a higher priority than the active firewall to ensure it takes over immediately.
   • CEnable session setup and state synchronization between the peers, and configure the passive firewall to pre-allocate session resources.
   • DSet the HA timer values to the minimum allowed and disable state synchronization to reduce CPU overhead on the passive peer.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A gaming company runs a VM-Series pair in active/passive HA. The game uses UDP for real-time voice chat and TCP for matchmaking. The operations team reports that on failover, UDP voice sessions drop immediately, while TCP matchmaking sessions survive. The architect must improve UDP session continuity. What is the most effective configuration change?

   • AConfigure the game clients to use TCP instead of UDP for voice chat.
   • BEnable session setup and ensure UDP session state is synchronized to the passive firewall.
   • CDisable state synchronization for UDP sessions to reduce overhead.
   • DIncrease the HA failover timer to give the passive firewall more time to learn UDP sessions.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the Palo Alto Networks Hyperscale Security Fabric (HSF)?

   • ATo provide a single firewall instance that can handle unlimited throughput.
   • BTo provide a centralized management plane for multiple standalone firewalls.
   • CTo replace the need for hardware firewalls in all private cloud deployments.
   • DTo enable clustering of software firewalls for elastic scaling and high availability in hyperscale environments.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial institution is upgrading from PA-3060 firewalls (4th generation) to PA-5260 firewalls (5th generation) in an active/active HA deployment. The current network uses asymmetric routing, where traffic from a client to a server takes one path and the return traffic takes another. The architect must ensure that the new pair can handle this traffic pattern. What is the primary architectural consideration?

   • A5th generation firewalls require symmetric routing in active/active HA mode.
   • BThe architect must use a load balancer to ensure symmetric routing in active/active HA mode.
   • C4th generation firewalls support active/active HA with session ownership, so the upgrade is not necessary.
   • D5th generation firewalls support active/active HA with session ownership, allowing each firewall to handle sessions for traffic it receives, even with asymmetric routing.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A cloud provider is designing a multi-tenant firewall service using HSF. The provider must ensure that a tenant's UDP-based VoIP sessions are not dropped when a VM-Series node fails. The architect is considering whether to enable session setup and state synchronization. What is the most important consideration?

   • ASession setup and state synchronization must be enabled for UDP sessions to ensure continuity on node failure.
   • BHSF does not support state synchronization for UDP sessions.
   • CThe architect must use a load balancer to redirect UDP traffic to a new node on failure.
   • DSession setup is not required in HSF because nodes share a common session table.
   Reveal Solution Discussion Select an answer first