9.4 Design to Azure NGFW Standards NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–14

1. 11application · medium

   An organization is running a pair of Palo Alto Networks NGFWs in an active-passive configuration behind an internal Azure Load Balancer. The NGFWs inspect traffic between two application tiers in different subnets. The passive NGFW is not receiving any traffic, and the active NGFW is handling all traffic. The team notices that when the active NGFW fails, the passive NGFW does not take over as expected. What is the most likely cause?

   • AThe load balancer is using a public IP address, which prevents internal traffic from being distributed to the NGFWs.
   • BThe passive NGFW is not configured with the same routing table as the active NGFW, so it cannot accept the traffic.
   • CThe load balancer health probe is configured to check the management interface of the NGFWs instead of the dataplane interface.
   • DThe NGFWs are in different availability zones, and the load balancer is zone-redundant, so it only sends traffic to the active zone.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In an active-passive NGFW architecture in Azure, what is the typical role of health probes?

   • ATo monitor the health of the active firewall and trigger failover to the passive firewall if the active becomes unhealthy.
   • BTo measure the CPU and memory usage of the firewalls for capacity planning.
   • CTo distribute traffic evenly between the active and passive firewalls.
   • DTo encrypt traffic between the firewalls and the workloads.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of forced tunneling in an Azure NGFW insertion design?

   • ATo enable Azure Load Balancer to distribute traffic across multiple NGFW instances.
   • BTo route all outbound internet traffic from Azure subnets through the NGFW for inspection and policy enforcement.
   • CTo automatically encrypt all traffic between Azure VNets using IPsec without user configuration.
   • DTo prevent any traffic from leaving the Azure region by blocking all external routes.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is designing an active-active NGFW deployment in Azure to inspect traffic between multiple spoke VNets. The NGFWs will be placed behind an internal load balancer. The team wants to ensure that traffic flows are consistently handled by the same NGFW for the duration of a session. What must be configured to achieve this?

   • AEnable session persistence (source IP affinity) on the load balancer.
   • BPlace the NGFWs in the same availability set to ensure they are on the same physical host.
   • CConfigure the load balancer to use a hash of the source and destination IP and port.
   • DUse a public load balancer instead of an internal one.
   Reveal Solution Discussion Select an answer first