9.5 Design to GCP NGFW Standards NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In an active/passive HA deployment of NGFW in GCP, what is the primary role of the passive firewall?

   • ATo handle only management traffic
   • BTo actively process traffic in parallel with the active firewall
   • CTo monitor the active firewall and take over if it fails
   • DTo provide additional throughput for peak traffic
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is designing an NGFW deployment in GCP. They have two VPCs that need to communicate, and they want to inspect the traffic. They are considering two options: (1) deploy an NGFW in each VPC, or (2) use a centralized NGFW in a hub VPC. They are concerned about the cost of the deployment. What is the primary trade-off?

   • ABoth options have the same cost
   • BUsing a centralized NGFW provides better performance but higher cost
   • CDeploying an NGFW in each VPC provides better performance but higher cost
   • DThe cost is not a factor in this decision
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When integrating an internal load balancer with an NGFW for traffic steering, what is a key design consideration?

   • ATraffic must be routed to the NGFW before reaching the backend
   • BThe internal load balancer must be internet-facing
   • CThe NGFW must be deployed as a passthrough load balancer backend
   • DThe internal load balancer must be in the same region as the NGFW
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which GCP NGFW insertion mode is best suited for a design that requires centralized inspection of traffic from multiple VPCs, where each VPC connects to a central hub VPC that hosts the NGFW?

   • ACentralized inspection
   • BInline VPC
   • CHub-and-spoke
   • DTransitive peering
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is deploying an NGFW in GCP for a mission-critical application. They need to ensure that if the active NGFW fails, the passive NGFW takes over with minimal disruption. What should they configure to achieve this?

   • AA route that points to the passive node's IP address
   • BA floating IP address that moves to the passive node on failover
   • CA DNS record that points to the passive node
   • DA load balancer that distributes traffic to both NGFW instances
   Reveal Solution Discussion Select an answer first