2.1 Explain the Function of Cloud NGFWs, PA-Series, CN-Series, and VM-Series Firewalls (e.g., Perimeter and Core Security, Zone Security and Segmentation, High Availability [HA], Security and NAT Policy Implementation, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which firewall type is a virtual appliance designed for virtualized and private cloud environments?

   • ACloud NGFW
   • BPA-Series
   • CCN-Series
   • DVM-Series
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An enterprise runs a PA-Series firewall pair in active/passive HA at its data center perimeter. The security team needs to ensure that session state is preserved during failover so that existing connections are not dropped. What must be configured on the HA pair?

   • ASet up a VPN tunnel between the two firewalls.
   • BUse a load balancer in front of the firewalls.
   • CConfigure the HA pair in active/active mode.
   • DEnable session synchronization on the HA pair.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A network administrator is configuring a PA-Series firewall with multiple zones: Inside (trusted), Outside (untrusted), and DMZ (semi-trusted). The administrator needs to create a security policy that allows the Inside zone to access the DMZ zone, but only on specific ports (e.g., 80 and 443). The policy must also allow the DMZ zone to respond to the Inside zone. Which policy configuration is correct?

   • ACreate a policy from Inside to DMZ allowing all ports, and a policy from DMZ to Inside denying all ports.
   • BCreate a single policy from Inside to DMZ allowing ports 80 and 443, and rely on the firewall's stateful inspection to allow return traffic.
   • CCreate a policy from Inside to DMZ allowing ports 80 and 443, and a policy from DMZ to Inside allowing ports 80 and 443.
   • DCreate two policies: one from Inside to DMZ allowing ports 80 and 443, and another from DMZ to Inside allowing all ports.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which type of NAT translates multiple private IP addresses to a single public IP address?

   • ADouble NAT
   • BSource NAT (SNAT) with port address translation (PAT)
   • CDestination NAT (DNAT)
   • DStatic NAT
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses a PA-Series firewall to provide internet access to internal users. The internal network uses RFC 1918 addresses, and the firewall has a single public IP address on its external interface. The security team wants to allow internal users to access the internet while hiding their private addresses. Which NAT policy configuration should be used?

   • ACreate a destination NAT policy that translates the public IP to internal server addresses.
   • BCreate a source NAT policy that translates internal source addresses to the public IP of the firewall's external interface.
   • CDisable NAT and use routing to allow internal users to reach the internet.
   • DConfigure a static NAT policy that maps each internal user to a unique public IP.
   Reveal Solution Discussion Select an answer first