10.5 Explain Layer 3 Deployment Routing Considerations NETWORK-SECURITY-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company runs a VM-Series firewall in an active/passive HA pair. The upstream router uses OSPF, and the downstream core switch uses static routes pointing to the firewall's interface IPs. The network team wants the firewall to advertise a default route into OSPF so the upstream router can reach the downstream subnets. The downstream core switch must continue using static routes. Which configuration on the VM-Series firewall satisfies this requirement?

   • AConfigure OSPF on the downstream interface and enable OSPF on the core switch to exchange routes.
   • BUse BGP to advertise the default route to the upstream router instead of OSPF.
   • CAdd a static route on the upstream router pointing to the firewall for all downstream subnets.
   • DCreate a static default route with next hop to the core switch, then redistribute static routes into OSPF.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of redistributing routes into BGP?

   • ATo allow BGP to learn about internal networks that are not directly connected to the BGP-speaking router
   • BTo convert BGP routes into static routes for the routing table
   • CTo reduce the number of BGP peers in the network
   • DTo automatically assign BGP attributes to all interfaces
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise has a PA-Series firewall that redistributes routes between OSPF and BGP. The firewall is connected to an internal OSPF network and an external BGP peer. The network team has configured mutual redistribution: OSPF into BGP and BGP into OSPF. After the configuration, they notice that some OSPF routes are being advertised into BGP, then learned back via BGP, and re-advertised into OSPF, causing suboptimal routing and potential loops. They also observe that the OSPF routing table is growing with external routes that should not be there. What is the most comprehensive solution to prevent this issue?

   • AIncrease the administrative distance of BGP routes to make them less preferred than OSPF routes.
   • BDisable BGP redistribution into OSPF and rely on static routes for external networks.
   • CUse route tags to mark routes redistributed from OSPF into BGP, and filter these tagged routes when redistributing BGP back into OSPF.
   • DUse a route map to filter all BGP routes from being redistributed into OSPF.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a common risk when redistributing routes between OSPF and another protocol?

   • AThe loss of all static routes in the routing table
   • BOSPF becoming unable to calculate the shortest path tree
   • CRouting loops caused by routes being fed back into the originating protocol
   • DThe firewall's data plane becoming overloaded with routing updates
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A small branch office has a single PA-Series firewall connecting to the corporate headquarters via a site-to-site VPN. The branch has only one subnet (192.168.10.0/24) and no dynamic routing protocol is running. The network administrator wants to ensure that all traffic from the branch to the corporate network (10.0.0.0/8) is sent through the VPN tunnel, and all other traffic is sent to the local ISP. What is the most appropriate routing configuration on the branch firewall?

   • AUse BGP to exchange routes with the corporate router over the VPN.
   • BConfigure a static route for 10.0.0.0/8 with next hop to the VPN tunnel interface, and a default route to the ISP.
   • CConfigure a default route through the VPN tunnel and a static route for the ISP.
   • DEnable OSPF on the VPN tunnel to learn the corporate routes dynamically.
   Reveal Solution Discussion Select an answer first