A company is deploying a Palo Alto Networks NGFW pair in Azure to protect a mission-critical application. The design must be resilient to a complete availability zone failure and also to a hardware failure within a zone. The NGFWs will be managed as a single HA pair. Which deployment strategy meets these requirements?

Deploy both NGFWs in the same availability zone and in the same availability set.

Deploy both NGFWs in different availability zones and do not place them in an availability set.

Deploy both NGFWs in the same availability zone but in different availability sets.

Deploy one NGFW in one availability zone and the other in a different availability zone, each in its own availability set.

In an Azure hub-and-spoke network topology, which method is commonly used to insert an NGFW so that it can inspect traffic between spoke virtual networks?

Attach the NGFW directly to the Azure backbone and enable VNet peering to all spokes to intercept traffic.

Place the NGFW in a spoke VNet and configure user-defined routes (UDRs) in the hub to direct inter-spoke traffic to it.

Use Azure Firewall Manager to automatically insert the NGFW into every spoke VNet without any manual routing.

Deploy the NGFW in the hub VNet and use VNet peering with user-defined routes (UDRs) to route inter-spoke traffic through the NGFW.

What is a key characteristic of an active-active NGFW architecture in Azure?

Only one NGFW instance is deployed, but it is configured to handle all traffic with multiple virtual systems.

The NGFW instances are placed in different Azure regions to provide geo-redundancy.

Both NGFW instances actively process traffic simultaneously, and traffic is distributed between them.

One NGFW instance is active while the other remains idle until a failure occurs.

When designing an NGFW HA pair in Azure, what is the primary purpose of placing the two firewall instances in different availability zones?

To protect against a failure of an entire Azure data center (zone) by ensuring the HA pair is spread across independent fault domains.

To reduce network latency between the firewalls and the workloads they protect.

To allow the firewalls to use different Azure regions for disaster recovery.

To enable the firewalls to share a single public IP address for outbound traffic.

In an Azure NGFW HA design, what is the role of an availability set?

To automatically scale the NGFW instances based on CPU usage.

To distribute the NGFW instances across different Azure regions for disaster recovery.

To group the NGFW instances so that they are placed on different physical racks and update domains within the same data center.

To provide a single private IP address for the HA pair to use as a virtual IP.

Palo Alto NetworksCertified Network Security Architect

Domain 9Objective 4

9.4 Design to Azure NGFW Standards NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Part of the Public Cloud domain, which accounts for 11% of the NETWORK-SECURITY-ARCHITECT exam.

14questions here

3free pages

4concepts

11%of the exam

Questions 1–5

1application · medium
A company is deploying a Palo Alto Networks NGFW pair in Azure to protect a mission-critical application. The design must be resilient to a complete availability zone failure and also to a hardware failure within a zone. The NGFWs will be managed as a single HA pair. Which deployment strategy meets these requirements?
Select an answer first
2foundation · easy
In an Azure hub-and-spoke network topology, which method is commonly used to insert an NGFW so that it can inspect traffic between spoke virtual networks?
Select an answer first
3foundation · easy
What is a key characteristic of an active-active NGFW architecture in Azure?
Select an answer first
4foundation · easy
When designing an NGFW HA pair in Azure, what is the primary purpose of placing the two firewall instances in different availability zones?
Select an answer first
5foundation · easy
In an Azure NGFW HA design, what is the role of an availability set?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.