9.4 Design to Azure NGFW Standards NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company wants to use a Palo Alto Networks NGFW to inspect all outbound internet traffic from a spoke VNet. The spoke VNet has no direct internet connectivity, and all traffic must be forced through the NGFW, which is deployed in a hub VNet. What is the correct way to achieve this?

   • AUse VNet peering and rely on the peering to automatically route internet traffic through the NGFW.
   • BConfigure a user-defined route in the spoke subnet with the NGFW's internal load balancer front-end IP as the next hop for 0.0.0.0/0.
   • CDeploy a second NGFW in the spoke VNet and configure it as the default gateway.
   • DConfigure the spoke VNet's DNS settings to point to the NGFW.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is deploying an active-active NGFW pair in Azure to inspect traffic between two application subnets. The NGFWs are behind an internal load balancer. The team wants to ensure that if one NGFW fails, the remaining NGFW can handle the traffic without dropping sessions. What is the most important consideration?

   • AConfigure the load balancer to use session persistence so that all packets of a session go to the same NGFW.
   • BUse a public load balancer to allow internet traffic to reach the NGFWs.
   • CPlace the NGFWs in different availability zones to ensure they are on different hardware.
   • DEnsure the NGFWs are in the same availability set to minimize latency.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Azure Load Balancer feature is essential to ensure that return traffic from an NGFW instance follows the same path back to the client when using a Standard Load Balancer?

   • ASession persistence based on client source IP
   • BOutbound SNAT rules on the load balancer
   • CFloating IP (Direct Server Return)
   • DHealth probes configured with TCP on port 443
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In an Azure NGFW deployment, what is the role of an internal (private) Standard Load Balancer?

   • ATo distribute inbound internet traffic to the NGFW instances from the public internet.
   • BTo provide outbound internet connectivity for the NGFW instances using SNAT.
   • CTo distribute internal traffic from Azure subnets to the NGFW instances for inspection.
   • DTo replace the need for user-defined routes by automatically routing traffic to the NGFW.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is deploying a pair of Palo Alto Networks NGFWs in an active-passive configuration. The active NGFW is in availability zone 1, and the passive NGFW is in availability zone 2. They are placed behind an internal load balancer. The team wants to ensure that if the active NGFW fails, the passive NGFW automatically takes over. What is the most important configuration to enable this?

   • AAssign a static public IP to the passive NGFW so it can accept traffic.
   • BConfigure a health probe on the load balancer that checks the dataplane interface of the NGFWs.
   • CPlace both NGFWs in the same availability set to ensure they are on the same hardware.
   • DConfigure the load balancer to use a floating IP (Direct Server Return) for the NGFWs.
   Reveal Solution Discussion Select an answer first