A company has a site-to-site VPN between their on-premises network and an AWS VPC. The VPN terminates on a Palo Alto firewall in the VPC. They are planning an OS upgrade for the firewall. What is the best practice to ensure the VPN connection remains available during the upgrade?

Configure a second VPN tunnel to a second firewall instance in a different availability zone.

Schedule the upgrade during off-peak hours and accept the brief VPN outage.

Disable the VPN tunnel on the on-premises device before the upgrade.

Upgrade the firewall without any preparation, as the VPN will automatically re-establish.

A company is choosing between a centralized and a decentralized firewall architecture for a multi-VPC AWS environment. They have a small security team and need to enforce a consistent security policy across all VPCs. Which architecture is more appropriate, and what is the primary trade-off?

Decentralized, which provides high availability but makes policy management more complex.

Decentralized, which is always more cost-effective than centralized.

Centralized, which simplifies policy management but creates a potential single point of failure and a traffic bottleneck.

Centralized, which provides the lowest latency for all traffic.

What is a key high availability consideration when deploying VPN termination in a cloud environment?

Deploying multiple VPN gateways in different availability zones

Configuring the VPN gateway with a private IP address only

Using a single VPN gateway with a large instance size

Placing the VPN gateway in the same availability zone as the application

A company has a site-to-site VPN terminating on a single Palo Alto firewall in Azure. They need to upgrade the firewall OS. The business requires zero downtime for the VPN. They have a second firewall available but it is not currently configured. What is the most appropriate approach?

Deploy the second firewall, configure it as a standby in a high-availability pair, and then perform a rolling upgrade.

Use Azure's built-in VPN gateway as a backup during the upgrade.

Upgrade the single firewall during a scheduled maintenance window and accept the downtime.

Create a second VPN tunnel to the same firewall and use it during the upgrade.

What is a primary design consideration for SSL decryption in a cloud environment?

Disabling SSL decryption for all traffic to reduce latency

Placing the firewall in the same subnet as the web servers

Using a single certificate for all domains to simplify management

Ensuring the firewall has access to the private keys of the certificates used by the traffic

Palo Alto NetworksCertified Network Security Architect

Domain 9Objective 2

9.2 Design for Maintenance and Security Across CSP Environments NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Part of the Public Cloud domain, which accounts for 11% of the NETWORK-SECURITY-ARCHITECT exam.

19questions here

4free pages

4concepts

11%of the exam

Questions 11–15

11application · medium
A company has a site-to-site VPN between their on-premises network and an AWS VPC. The VPN terminates on a Palo Alto firewall in the VPC. They are planning an OS upgrade for the firewall. What is the best practice to ensure the VPN connection remains available during the upgrade?
Select an answer first
12application · medium
A company is choosing between a centralized and a decentralized firewall architecture for a multi-VPC AWS environment. They have a small security team and need to enforce a consistent security policy across all VPCs. Which architecture is more appropriate, and what is the primary trade-off?
Select an answer first
13foundation · easy
What is a key high availability consideration when deploying VPN termination in a cloud environment?
Select an answer first
14expert · hard
A company has a site-to-site VPN terminating on a single Palo Alto firewall in Azure. They need to upgrade the firewall OS. The business requires zero downtime for the VPN. They have a second firewall available but it is not currently configured. What is the most appropriate approach?
Select an answer first
15foundation · easy
What is a primary design consideration for SSL decryption in a cloud environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.